Core Contracts

Summary

The BoostController::delegateBoost function allows users to delegate their veToken balance to another address. However, there is no restriction preventing users from delegating their entire balance to multiple recipients. This creates a situation where a user can amplify their influence beyond their actual holdings, manipulating governance, rewards, or other benefits tied to delegation.

Vulnerability Details

The function BoostController::delegateBoost performs several checks to ensure valid delegation, such as verifying that the delegation amount does not exceed the user's balance and that the delegation duration is within allowed limits. However, it does not track the total amount delegated across multiple recipients. This allows a user to delegate their full balance to one recipient and then repeat the process for additional recipients, effectively bypassing the intended delegation limit.

Affected Code:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/boost/BoostController.sol#L212

Impact

This vulnerability allows a user to delegate their entire balance to multiple recipients. This can result in governance manipulation, unfair reward distribution, or other unintended protocol exploits.

Tools Used

• Manual code review

Recommendations

1. Track Total Delegated Amount: Maintain a mapping (totalDelegated) to track the total delegated amount for each user. Before allowing a new delegation, ensure that the sum of all delegated amounts does not exceed the user's balance:

   if (totalDelegated[msg.sender] + amount > userBalance) revert InsufficientVeBalance();

   totalDelegated[msg.sender] += amount;