Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing update mechanism for time-weighted values in `BaseGauge`

falendar

Summary

The BaseGauge contract lacks any mechanism to update the value in its TimeWeightedAverage Period after initialization.

Vulnerability Details

In the BaseGauge constructor, the TimeWeightedAverage Period is initialized with a value of 0:

TimeWeightedAverage.createPeriod(
periodState.votingPeriod,
nextPeriod,
_periodDuration,
> 0,
10000
);

The TimeWeightedAverage library provides an update mechanism through updateValue:

function updateValue(
Period storage self,
uint256 newValue,
uint256 timestamp
) internal {
if (timestamp < self.startTime || timestamp > self.endTime) {
revert InvalidTime();
}
​
unchecked {
uint256 duration = timestamp - self.lastUpdateTime;
if (duration > 0) {
uint256 timeWeightedValue = self.value * duration;
if (timeWeightedValue / duration != self.value) revert ValueOverflow();
self.weightedSum += timeWeightedValue;
self.totalDuration += duration;
}
}
​
self.value = newValue;
self.lastUpdateTime = timestamp;
}

However, there is no code path that ever calls TimeWeightedAverage.updateValue. This means the value in the Period struct remains at its initial value of 0, regardless of any activity.

Impact

The calculateAverage in TimeWeightedAverage will always return 0.

Recommendations

Implement an update mechanism.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::stake, voteDirection and withdraw don't call _updateWeights, causing outdated time-weighted average calculations that lead to unfair reward distribution

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::stake, voteDirection and withdraw don't call _updateWeights, causing outdated time-weighted average calculations that lead to unfair reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!