Core Contracts

Summary

The _applyBoost function retrieves the veRAACToken contract address from the IGaugeController(controller) on every function call, which introduces unnecessary gas costs due to repeated external contract calls. This could be optimized by storing the token address in the contract's constructor instead of fetching it dynamically.

Vulnerability Details

External contract calls (like controller.veRAACToken()) are expensive, as they require reading storage from another contract.

Since the veRAACToken address is unlikely to change, storing it once in the constructor would save gas on every function execution.

Impact

Higher Gas Costs per Call

• Every function execution requires an extra external call to fetch veRAACToken, increasing transaction costs.

• This issue is amplified in high-frequency function calls, such as within staking, voting, or reward distribution mechanisms.

Unnecessary External Dependency

• If the external call fails due to unforeseen reasons (e.g., controller malfunction), _applyBoost will fail even though the token address is known.

• This adds unnecessary complexity and potential failure points.

Reduced Efficiency & Scalability

• Fetching the token dynamically does not provide additional benefits, and storing it once would improve contract efficiency.

• Gas costs can accumulate, making the contract less competitive compared to optimized alternatives.

Tools Used

Manual Review

Recommendations

Add this to constructor :

constructor(address _controller) {

controller = _controller;

veToken = IERC20(IGaugeController(controller).veRAACToken()); // Store once

}