Summary

if the maxLockingDuration in the LinearBoostController is different across chains, and a user transfers his lock from the chain with the smaller maxLockingDuration to the larger one, and transfers tokens to that lockId with the same lockingduration, if the new calculated boostedAmount is less than the former one, his transfered funds will not be added to his balance.

Vulnerability Details

the function to executeQueuedOperations is defined as so

in the function _executeQueuedLockUpdates(msg.sender, _lockIds)
the int256 boostAmountDiff = int256(updateLockState.boostAmount) - int256(curLockState.boostAmount);
if the boostAmountDiff is negative, the lock.expiry is set to the new lock expiry and the boostAmount is set to 0 but the token transferred by the user is not added to their balance

Impact

the difference in maxLockingDuration can lead to loss of funds for users

Tools Used

manual audit

Recommendations

always ensure that maxBoost and maxLockingDuration are consistent across chains or prevent users from transfering their tokens if there is difference in maxLockingDuration