Core Contracts

Summary

The minBoost parameter in BoostState is incorrectly initialized in BaseGauge.sol, leading to a potential revert in the calculateBoost function within BoostCalculator.sol. This issue arises because minBoost is set to 1e18, whereas it should be 10000 to align with the calculations in calculateBoost.

Vulnerability Details

In the constructor of BaseGauge.sol, boostState.maxBoost is set to 25000, and boostState.minBoost is incorrectly set to 1e18. However, within calculateBoost in BoostCalculator.sol, the function subtracts minBoost from maxBoost:

Since minBoost is significantly larger than maxBoost (1e18 vs. 25000), this subtraction results in an underflow, causing the function to revert when executed.

Expected values for correct calculation:

• maxBoost = 25000

• minBoost = 10000

Impact

This incorrect initialization prevents the boost calculation from functioning correctly, leading to transaction failures when users attempt to retrieve their boosted amounts.

Tools Used

Manual review

Recommended Mitigation

Update the initialization of boostState.minBoost in BaseGauge.sol to 10000 instead of 1e18:

This change ensures that the boostRange calculation in BoostCalculator.sol functions correctly, preventing unnecessary reverts and maintaining expected protocol behavior.