Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Performance share is not distributed in `distributeRevenue()` function

0xgremlincat

Summary

In GaugeController.sol, emergency admin can call distributeRevenue()function whereby 80% of the amount is distributed to veRAAC holders, while the remaining 20% is attributed to the performance fee. However, the 20% is not distributed anywhere.

Vulnerability Details

function distributeRevenue(
GaugeType gaugeType,
uint256 amount
) external onlyRole(EMERGENCY_ADMIN) whenNotPaused {
if (amount == 0) revert InvalidAmount();
uint256 veRAACShare = amount * 80 / 100; // 80% to veRAAC holders
uint256 performanceShare = amount * 20 / 100; // 20% performance fee
revenueShares[gaugeType] += veRAACShare;
_distributeToGauges(gaugeType, veRAACShare);
emit RevenueDistributed(gaugeType, amount, veRAACShare, performanceShare);
}

As seen in the function above, veRAACshare is calculated to define the amount to be distributed to veRAAC holders and then used to update the accounting in revenueShares mapping. Then, the veRAACShare is distributed to the gauges via _distributeToGauges().

  1. The calculated performanceShare is not used to update the existing performanceFees mapping as defined in the contract:

    mapping(address => uint256) public performanceFees; // 20% yield products

  2. There is no handling of the perfomanceShare being actually distributed at all.

Impact

Performance shares are never distributed to gauges, breaking core functionality of the protocol.

Tools Used

Manual

Recommendations

Ensure that performanceShare is distributed to gauge and accounting done for performanceFees mapping.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.