maxBoost change will make users boost value to be 0
Summary
In case if maxBoost value inside LinearBoostController will be decreased, then user of SDLPoolSecondary can get boosts to be set to 0 even when he is not initiating withdraw.
Vulnerability Details
When lock is updated, then new boostAmount is calculated for it. It's possible that maxBoost will be changed. In case if it will be decreased it means that update of lock(adding new amount of extending) will cause boost difference with previous lock's state to be negative.
This is the problem for the SDLPoolSecondary, which in such cases believes, that user has initiated withdraw and his boost is 0 then. In such case it will set lock's boost to 0.
This means that even that user didn't request withdraw, his boost is 0 and he receives less amount of rewards with this lock.
Impact
User's boost is set to 0.
Tools Used
VsCode
Recommendations
Decrease lock's boost value with difference among 2 states.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.