Skip to content

Latest commit

 

History

History
33 lines (18 loc) · 3.06 KB

178.md

File metadata and controls

33 lines (18 loc) · 3.06 KB
Raw

Low Ash Shetland

High

The GammaRewarder.sol's :: handleProofVerification function will not work as intended

Summary

The BrevisApp.sol contract has a function- brevisCallback which calls another internal VIRTUAL function- handleProofResult as can be seen in Lines 28-29 which is a function for handling the proof verification results which takes the following as the input params- bytes32 _requestId, bytes32 _vkHash, bytes calldata _appCircuitOutput The bytes32 _requestId param is needed to get the appVkHash and this hash is used to verify the request that is allowed for rewards. Now the issue that arises here is that the handleProofResult function is overriden by the the GammaRewarder.sol . And in the function in the GammaRewarder does not include the _requestId param which can be seen - here. This issue might prevent the handleProofResult to work as intended.

Root Cause

In GammaRewarder.sol the handleProofResult will not work as intended due to the missing _requestId param

Impact

The handleProofVerification will not work as it is intended to due to the missing input parameter in the overriden function. This can prove to be catastrophic because of missing _requestId the verification of the request that is allowed for rewards will always fail and because of that user wont be able to get the rewards for being the LP.

PoC

https://github.com/sherlock-audit/2024-10-gamma-rewarder/blob/main/GammaRewarder/contracts/brevis/lib/BrevisApp.sol#L25

https://github.com/sherlock-audit/2024-10-gamma-rewarder/blob/main/GammaRewarder/contracts/brevis/lib/BrevisApp.sol#L28C3-L29C42

https://github.com/sherlock-audit/2024-10-gamma-rewarder/blob/main/GammaRewarder/contracts/GammaRewarder.sol#L187

Mitigation

Include the missing bytes32 _requestd param in the handleProofResult that is overridden in the GammaRewarder.sol contract:

- function handleProofResult(bytes32, bytes32 _vkHash, bytes calldata _appCircuitOutput) internal override + function handleProofResult(bytes32 _requestId, bytes32 _vkHash, bytes calldata _appCircuitOutput) internal override