Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

wrong earned logic in `BaseGauge`

ChainDefenders

Summary

In the BaseGauge contract, users can stake tokens and receive rewards. However, the reward calculation is based on voting power in the VACCToken, rather than the actual amount of tokens staked in the gauge. This removes the incentive to stake tokens, as rewards are not tied to the user's staked balance.

Relevant Code

function stake(uint256 amount) external nonReentrant updateReward(msg.sender) {
if (amount == 0) revert InvalidAmount();
_totalSupply += amount;
_balances[msg.sender] += amount;
stakingToken.safeTransferFrom(msg.sender, address(this), amount);
emit Staked(msg.sender, amount);
} // ok
​
/**
* @notice Withdraws staked tokens
* @param amount Amount to withdraw
*/
function withdraw(uint256 amount) external nonReentrant updateReward(msg.sender) {
if (amount == 0) revert InvalidAmount();
if (_balances[msg.sender] < amount) revert InsufficientBalance();
_totalSupply -= amount;
_balances[msg.sender] -= amount;
stakingToken.safeTransfer(msg.sender, amount);
emit Withdrawn(msg.sender, amount);
}

Vulnerability Details**

1. Misaligned Incentive Mechanism

  • The rewards are not calculated based on _balances[msg.sender] (staked tokens) but instead on the voting power in VACCToken.

  • This means a user who stakes more tokens does not necessarily earn more rewards.

  • A user with high voting power but no staked may will receive more rewards than someone with a large stake but no voting power.

2. Discourages Staking

  • Since staking does not directly affect rewards, users may avoid staking in the gauge altogether.

Impact

  1. Reduced Participation: Users are less likely to stake if rewards are not tied to their staked amount.

  2. Unfair Reward Distribution: A user with no stake but high voting power may earn disproportionate rewards.

Tools Used

Manual Review

Recommendations

Decide how you want to give rewards, based on voting power or staking, and remove the unnecessary logic.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::earned calculates rewards using getUserWeight instead of staked balances, potentially allowing users to claim rewards by gaining weight without proper reward checkpoint updates

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::earned calculates rewards using getUserWeight instead of staked balances, potentially allowing users to claim rewards by gaining weight without proper reward checkpoint updates

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.