Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

In notifyReward() function, the new reward rate overwrite the old reward rate

0xgremlincat

Summary

In BaseGauge.sol, notifyReward()function notifies about the new reward amount and recalculates the reward rate. However, the calculation does not account for the current reward rate and instead overwrites the current reward rate entirely.

Vulnerability Details

/**
* @notice Notifies contract of reward amount
* @dev Updates reward rate based on new amount
* @param amount Amount of rewards to distribute
*/
function notifyRewardAmount(uint256 amount) external override onlyController updateReward(address(0)) {
if (amount > periodState.emission) revert RewardCapExceeded();
rewardRate = notifyReward(periodState, amount, periodState.emission, getPeriodDuration());
periodState.distributed += amount;
uint256 balance = rewardToken.balanceOf(address(this));
if (rewardRate * getPeriodDuration() > balance) {
revert InsufficientRewardBalance();
}
lastUpdateTime = block.timestamp;
emit RewardNotified(amount);
}

The notifyReward()function is called internally from notifyRewardAmount() as seen above, and is expected to update the reward rate based on the new amount.

function notifyReward(
PeriodState storage state,
uint256 amount,
uint256 maxEmission,
uint256 periodDuration
) internal view returns (uint256) {
if (amount > maxEmission) revert RewardCapExceeded();
if (amount + state.distributed > state.emission) {
revert RewardCapExceeded();
}
​
uint256 rewardRate = amount / periodDuration;
if (rewardRate == 0) revert ZeroRewardRate();
​
return rewardRate;
}

In the function above, line 12 calculates the rewardRate based on the amount value and period duration alone. It does not account for any existing rewards that may already be accruing. The reward rate is not accumulated and overwrites the reward rate instead of calculating a new reward rate based on the amount.

Impact

Reward rate will be calculated incorrectly and affect distributed rewards. Reward rate can also change and jump drastically instead of smoothly adjusting.

Tools Used

Manual

Recommendations

Ensure that the old reward rate is not overwritten but instead is factored in when recalculating the new reward rate.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge's notifyRewardAmount overwrites reward rates without accounting for undistributed rewards, allowing attackers to reset admin-distributed rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.