Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Inaccurate boost reporting in `calculateBoost()`

tigerfrake

Summary

The calculateBoost() function currently returns the boostBasisPoints and boostedAmount without normalizing these values to adhere to the defined minimum and maximum boost limits (1x and 2.5x). This oversight leads to incorrect returned values that do not reflect the actual boost attainable within the protocol's constraints.

Vulnerability Details

In the current implementation, the calculateBoost() function computes the boostedAmount based on user voting power and other parameters.

function calculateBoost(
address user,
address pool,
uint256 amount
) external view override returns (uint256 boostBasisPoints, uint256 boostedAmount) {
---SNIP---
// @audit-issue Returns values without normalization
>> return BoostCalculator.calculateTimeWeightedBoost(
params,
userVotingPower,
totalVotingPower,
amount
);
}

However, it does not enforce the normalization of this amount to ensure it falls within the specified limits.

Impact

As a result, callers may receive inflated or misleading values that do not accurately represent the boost they can achieve.

Tools Used

Manual Review

Recommendations

Implement logic within the calculateBoost() function to ensure that the returned boostedAmount adheres to the defined minimum and maximum boost limits.

function calculateBoost(
address user,
address pool,
uint256 amount
) external view override returns (uint256 boostBasisPoints, uint256 boostedAmount) {
---SNIP---
- return BoostCalculator.calculateTimeWeightedBoost(
// @audit Retrieve return values
+ (boostBasisPoints, boostedAmount) = BoostCalculator.calculateTimeWeightedBoost(
params,
userVotingPower,
totalVotingPower,
amount
);
​
// @audit Normalize `boostedAmount` to meet min and max boost requirements
+ if (boostedAmount < amount) {
// @audit Ensure at least the base amount
+ boostedAmount = amount;
+ boostBasisPoints = MIN_BOOST;
+ } else {
+ uint256 maxBoostAmount = amount * MAX_BOOST / 10000;
+ if (boostedAmount > maxBoostAmount) {
// @audit Cap at max boost
+ boostedAmount = maxBoostAmount;
+ boostBasisPoints = MAX_BOOST;
+ }
+ }
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController removes pool boost on delegation removal without adding it on delegation creation, leading to accounting inconsistencies and potential underflows

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.