Core Contracts

Summary

The delegateBoost function in the BoostController contract allows users to delegate more boost than they actually have. The function only checks whether the delegated amount exceeds the user's current balance but does not track the cumulative delegated amount. As a result, a user can delegate their entire boost multiple times, either to one or multiple users, effectively bypassing the intended restrictions.

Vulnerability Details

The vulnerability arises due to missing checks when delegating boosts. While the delegateBoost function checks if the delegation amount is less than or equal to the user's available boost, it does not track the total amount delegated across multiple recipients. This oversight allows malicious users to delegate their entire boost to one user and then do the same to another, leading to an inflated delegated boost.

Affected Code: BoostController::DelegateBoost

Proof of Concept (PoC)

To demonstrate the vulnerability, add the following getter function to the BoostController.sol contract:

Then, include the following test case in the BoostController.test.js file:

When this test is run, it demonstrates that a user can delegate more boost than they own, highlighting the vulnerability.

Impact

This vulnerability can be exploited to:

• Inflate delegated boosts beyond the legitimate amount.

• Manipulate governance or staking mechanisms that rely on delegated boosts.

Tools Used

• Hardhat

Recommendations

To mitigate this issue:

1. Track Total Delegated Amount:
   Introduce a new state variable to track the total amount of boost delegated by each user.

2. Enhance Validation in delegateBoost:
   Update the delegateBoost function to check whether the requested delegation, when added to the already delegated amount, exceeds the user's available balance.