Core Contracts

Summary

The function _getBaseWeight is responsible for retrieving the user's current weight including any boosts. Unfortunately, even though the function accepts the parameter address account, it is not utilised within the execution process. Instead, we retrieve the contract's current gauge weight.

Vulnerability Details

The following line of code exhibits the vulnerability:

The account in context may have a balance, like 7500 (per the value in tests used as example via setInitialWeight) whereas the contract could have n leftover, or simply 0, which regardless, demonstrates incorrect accounting.

Impact

This would have a domino effect on functions which utilise this function, such as:

• getUserWeight, which then negatively reflects on the process of _applyBoost

• earned() calculation as it uses getUserWeight() within its operation for accounting reasons

• _updateReward as it executes earned()

Tools Used

Manual review

Recommendations

Correctly address the account and not the contract.