Submission Details
Severity:
_calculateReward in GaugeCOntroller.sol will return wrong amount because of _CalculateRWAEmissions() and _CalculateRAACEmission()
Summary
_calculateReward in GaugeCOntroller.sol will return wrong amount because of _CalculateRWAEmissions() and _CalculateRAACEmission()
Vulnerability Details
the _calculateReward is not updated bades on the actual emission rate, but are calculated on example value ->
function _calculateReward(address gauge) internal view returns (uint256) {
Gauge storage g = gauges[gauge];
uint256 totalWeight = getTotalWeight();
if (totalWeight == 0) return 0;
uint256 gaugeShare = (g.weight * WEIGHT_PRECISION) / totalWeight; //xe4
uint256 typeShare = (typeWeights[g.gaugeType] * WEIGHT_PRECISION) / MAX_TYPE_WEIGHT;
// Calculate period emissions based on gauge type
uint256 periodEmission = g.gaugeType == GaugeType.RWA ? _calculateRWAEmission() : _calculateRAACEmission(); // <= Here
return (periodEmission * gaugeShare * typeShare) / (WEIGHT_PRECISION * WEIGHT_PRECISION);
}
/**
* @notice Calculates RWA emission rate
* @dev Monthly emission rate for RWA gauges
* @return Monthly emission amount
*/
function _calculateRWAEmission() internal view returns (uint256) {
// Monthly RWA emission calculation
// This should be implemented based on your tokenomics
return 1000000 * 10 ** 18; // Example value
//@audit - This value should be updated to reflect the actual emission rate
}
/**
* @notice Calculates RAAC emission rate
* @dev Weekly emission rate for RAAC gauges
* @return Weekly emission amount
*/
function _calculateRAACEmission() internal view returns (uint256) {
// Weekly RAAC emission calculation
// This should be implemented based on your tokenomics
return 250000 * 10 ** 18; // Example value
//@audit - This value should be updated to reflect the actual emission rate
}
Impact
Incorrect calculations
Tools Used
Recommendations
The _CalculateRWAEmissions() and _CalculateRAACEmission() should return the actual emission rate
Updates
Lead Judging Commences
inallhonesty about 2 months ago
Submission Judgement Published Assigned finding tags:
GaugeController uses hardcoded placeholder emission values in _calculateRWAEmission() and _calculateRAACEmission() instead of actual tokenomics-based rates
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.