Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

The weight in the period will not be scaled by 1e18 in case the gaugeAdmin does not provide any initial weight when adding gauge

hard1k

Summary

The weight in the period will not be scaled by 1e18 in case the gaugeAdmin does not provide any initial weight when adding gauge

Vulnerability Details

In the addGauge function in the last part of the function the createPEriod is called which takes in many params but the main one here to look at is the weight param that is being passed in as initalWeight in the function. Now if the gaugeAdmin adds the gauge with an initial weight then it would work fine but in the case where the initial weight = 0 then the weight will be set to 1 . as can be seen here the isssue now here is that this weight that will be passed as 1 us supposed to be scaled by 1e18 decimal precision and that is not being done here. see me and see this too

Impact

not that high of a impact but still breaking an invariant as when 0 will be passed the weight will not be scaled byy 18 as it should

Tools Used

Manual Review

Recommendations

When the initialWeight is 0 edit the codeas such:
+ uint256 periodWeight = initialWeight == 0 ? 1 e18 : initialWeight;
- uint256 periodWeight = initialWeight == 0 ? 1 : initialWeight;

Code Snippets

function addGauge(
address gauge,
GaugeType gaugeType,
uint256 initialWeight
) external onlyGaugeAdmin {
if (gauges[gauge].lastUpdateTime != 0) revert GaugeAlreadyExists();
if (gaugeType != GaugeType.RWA && gaugeType != GaugeType.RAAC) {
revert InvalidGaugeType();
}
​
​
// Use minimum weight (1) for period tracking if initialWeight is 0
uint256 periodWeight = initialWeight == 0 ? 1 : initialWeight; //AUDIT- in case of 0 1 is passed in but is not scaled by 1e18
uint256 duration = gaugeType == GaugeType.RWA ? 30 days : 7 days;
​
​
gauges[gauge] = Gauge({
weight: initialWeight,
typeWeight: 0,
lastUpdateTime: block.timestamp,
gaugeType: gaugeType,
isActive: true,
lastRewardTime: block.timestamp
});
​
​
// Initialize period with current timestamp
TimeWeightedAverage.Period storage period = gaugePeriods[gauge];
TimeWeightedAverage.createPeriod(
period,
block.timestamp, // Start from current timestamp
duration,
periodWeight,
--> periodWeight
);```
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::addGauge uses unscaled value 1 for periodWeight when initialWeight is 0, causing gauge influence to be 10^18 times smaller than intended in TimeWeightedAverage calculations

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::addGauge uses unscaled value 1 for periodWeight when initialWeight is 0, causing gauge influence to be 10^18 times smaller than intended in TimeWeightedAverage calculations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.