QA Report

[code423n4]

Low Risk Vulnerabilities

1. No function to remove gauge from whitelist

If governance mistakenly whitelisted a faulty/malicious gauge, there is no way to remove it. A malicious gauge could mint as much $BKD as it's currently available according to the inflation schedule, in detriment of other gauges' allocation.

Recommended Mitigation Steps

Unless there's a reason not to, consider adding a function to remove gauge from whitelist in InflationManager.sol:

function blacklistGauge(address gauge) 
    external 
    override 
    onlyRoles(Roles.GOVERNANCE)
{
    gauges[gauge] = false;
}

Related Links

• https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/InflationManager.sol#L80-L82
• https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/InflationManager.sol#L181-L183

[GalloDaSballo]

Agree with the finding, given other findings in the contest it would be ideal to be able to remove gauges