stake.link

Summary

The lockId.boostAmount, of users who have locked their tokens, is not updated if maxBoost is changed.

Vulnerability Details

In order to calculate the boostAmount when a user stakes, the variable maxBoost is used (code line 38):

Afterwards, the boostAmount is used in the lockId creation or in the lockId update when user increases the duration of the locking.

The problem arises when the admin decides to change maxBoost because the new maxBoost will not be reflected in the boostAmount registered in the lockId of all users staking. Consider the following scenario:

maxBoost = 2; maxLockingDuration = 1 year

1. UserA stakes 10 tokens with a duration of 1 year, the boostAmount is 20, it is calculated as _amount * maxBoost * _lockingDuration / maxLockingDuration = (10 * 2 maxBoost * 1 year) / 1 year = 20

2. Admin changes maxBoost, now maxBoost = 1.

3. Now, the new UserA boostAmount should be 10, it would be calculated as _amount * maxBoost * _lockingDuration / maxLockingDuration = (10 * 1 maxBoost * 1 year) / 1 year = 10.

The problem is that the user's boostAmount is not modified after the maxBoost modification in step 2. In the example above, the user would prefer not to change his boostAmount after the maxBoost was modified simply because it is more convenient for the user since if he updates his boostAmount it will decrease.

In order to calculate rewards the docs says: This effective balance is used to determine the amount of benefit a user receives in various aspects of the protocol such as the amount of rewards received. So the rewards calculation uses effectiveBalances and the effectiveBalances may change if maxBoost is modified.

Impact

The boostAmount recorded in the lockIds will not change after maxBoost is modified, causing users to have an incorrect boostAmount and the rewards will be calculated wrongly.

Tools used

Manual review

Recommendations

Add an external function that helps update the lockId.boostAmount if applicable. Thus this function can be called by the owner of the lockId himself or by someone else.