Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect pool working supply update in BoostController's updateUserBoost function

incogknito

Summary

The updateUserBoost function incorrectly updates the pool's working supply by directly setting it to a single user's boost value, instead of properly accounting for all users' contributions.

Vulnerability Details

In the updateUserBoost function, the pool's working supply is updated using direct assignment:

function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
// ...
uint256 oldBoost = userBoost.amount;
uint256 newBoost = _calculateBoost(user, pool, 10000);
userBoost.amount = newBoost;
userBoost.lastUpdateTime = block.timestamp;
// Update pool totals
if (newBoost >= oldBoost) {
poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
} else {
poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
}
poolBoost.workingSupply = newBoost; // <-- Bug: Incorrect update
// ...
}

Here, the working supply is directly set to newBoost instead of being incrementally updated. This overwrites the entire pool's working supply with a single user's boost value and also the cumulative nature of the working supply is not preserved.

Impact

  • Loss of working supply data for all other users in the pool

  • Incorrect boost calculations for the entire pool

  • Unfair advantage to the last user updating their boost

Tools Used

  • Manual code review

Recommendations

The working supply should be updated incrementally, similar to how totalBoost is updated:

function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
// ... existing code ...
// Update pool totals safely
if (newBoost >= oldBoost) {
poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
poolBoost.workingSupply = poolBoost.workingSupply + (newBoost - oldBoost);
} else {
poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
poolBoost.workingSupply = poolBoost.workingSupply - (oldBoost - newBoost);
}
// ... rest of the code ...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost overwrites workingSupply with single user's boost value instead of accumulating, breaking reward multipliers and allowing last updater to capture all benefits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.