An adress can delegate boost to an infinty of adresses
Summary
The delegateBoost method doesn't memorize the number of boosts realized
Vulnerability Details
The boost controler allows an user to delegate a boost to other users.
The delegation variable stores the msg.sender and the receipt adress( to).
UserBoost storage delegation = userBoosts[msg.sender][to];
It allows multiple delagations as there is no check that the msg.sender already delegate once.
Impact
Medium Impact : There's some level of disruption to the protocol's functionality or availability.
High likelihood : Only need to possess tokens to be able to delegate to an infinty of wallets.
Tools Used
Manual review
Recommendations
Add a memory of delegated amounts or make the user boost a one dimensionnal array.
Lead Judging Commences
BoostController::delegateBoost lacks total delegation tracking, allowing users to delegate the same veTokens multiple times to different pools for amplified influence and rewards
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.