Core Contracts

Summary

Delegation can never be cancelled unless the delegate himself cancels it.

Vulnerability Details

BoostController#delegateBoost allows any account to delegate to any account.

But the delegation can be removed only if the delegate wants it to, so once the deadline is over, the delegation will still be active, as long as the delegate himself does not call removeBoostDelegation.

Impact

Impossible to change the delegate unless current delegate removes himself.

Recommendations

Allow the delegator to change the delegate.