Core Contracts

Summary

The BoostController::updateUserBoost function in the BoostController contract (contracts/core/governance/boost/BoostController.sol) lacks proper access control, allowing any external caller to update boost data for any user. This vulnerability enables malicious actors to manipulate boost parameters, potentially resulting in unfair advantages and undermining the protocol's economic model.

Vulnerability Details

• Issue:

  • The function is declared as external, meaning any account can call it.

  • There is no access control mechanism (e.g., onlyRole(MANAGER_ROLE) or require(msg.sender == user)).

  • As a result, an attacker can arbitrarily modify boost values for any user.

Impact

• Economic Manipulation:

  • Attackers can artificially increase their boost or reduce others’ boost, skewing rewards distribution.

• Unfair Advantage:

  • Malicious actors may gain undue benefits in reward systems or influence governance outcomes.

• Protocol Exploitation:

  • Manipulated boost data could destabilize the protocol’s economic model, leading to financial loss for legitimate participants.

Tools Used

• Manual Code Review

Recommendations

• Implement Role-Based Access Control:

  • Add an access control modifier such as onlyRole(MANAGER_ROLE) to ensure that only authorized accounts can update boost data:

    function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused onlyRole(MANAGER_ROLE) {

    // ... original logic ...

    }

• Alternative Approach:

  • If users should only update their own boost data, enforce a check to ensure that msg.sender is either the user or has the proper role:

    function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {

    require(msg.sender == user || hasRole(MANAGER_ROLE, msg.sender), "Unauthorized");

    // ... original logic ...

    }

• Conduct Further Testing:

  • Validate the fix with comprehensive unit tests and consider a formal audit to ensure no other functions are vulnerable to unauthorized modifications.