Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect revenue distribution`GaugeController::distributeRevenue` leads to loss of funds for `veRAACToken` holders

kiteweb3

Summary

The GaugeController::distributeRevenue is designed as the revenue distribution mechanism but it contains some errors in how it handles the allocation of protocol fees. The contract is designed to split revenue into:

  • 80% for veToken holders

  • 20% for performance fees

However, there are two critical issues:

  • the 80% portion meant for veRAACToken holders is distributed to gauges via _distributeToGauges This means the 80% portion for veToken holders is sent to gauges, with subsequent lose of revenue for verAACToken holder.

  • the 20% performance fee portion is calculated but never stored or distributed. The gauges receive wrongly the 80% instead of the 20%.

Vulnerability Details

function distributeRevenue(
GaugeType gaugeType,
uint256 amount
) external onlyRole(EMERGENCY_ADMIN) whenNotPaused {
if (amount == 0) revert InvalidAmount();
@> uint256 veRAACShare = amount * 80 / 100; // 80% to veRAAC holders
@> uint256 performanceShare = amount * 20 / 100; // 20% performance fee
@> revenueShares[gaugeType] += veRAACShare;
@> _distributeToGauges(gaugeType, veRAACShare);
emit RevenueDistributed(gaugeType, amount, veRAACShare, performanceShare);
}

Impact

The GaugeController::distributeRevenue incorrectly sends the veToken holders' share (80%) to the gauges through _distributeToGauges (that receive the wrong percentage 80% instead of 20%). This leads to direct financial loss for veRAACToken holders who never receive their 80% share. The distribution of protocol revenues doesn't work as expected.

Tools Used

Recommendations

Send performanceShare in _distributeToGauges and implement a mechanism for veRAACToken holder to receive their rewards.

function distributeRevenue(
GaugeType gaugeType,
uint256 amount
) external onlyRole(EMERGENCY_ADMIN) whenNotPaused {
if (amount == 0) revert InvalidAmount();
uint256 veRAACShare = amount * 80 / 100; // 80% to veRAAC holders
uint256 performanceShare = amount * 20 / 100; // 20% performance fee
revenueShares[gaugeType] += veRAACShare;
- _distributeToGauges(gaugeType, veRAACShare);
+ _distributeToGauges(gaugeType, performanceShare);
emit RevenueDistributed(gaugeType, amount, veRAACShare, performanceShare);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.