Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: medium
Valid

BoostController does not allow changing the delegate unless current delegate removes himself

Summary

Delegation can never be cancelled unless the delegate himself cancels it.

Vulnerability Details

BoostController#delegateBoost allows any account to delegate to any account.

But the delegation can be removed only if the delegate wants it to, so once the deadline is over, the delegation will still be active, as long as the delegate himself does not call removeBoostDelegation.

Impact

Impossible to change the delegate unless current delegate removes himself.

Recommendations

Allow the delegator to change the delegate.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController: Users unable to remove their own expired boost delegations, creating dependency on recipients and preventing efficient reallocation of boosts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!