Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Lack of validation for pool address when delegating boost can lead to loss of funds or exploit of boost rewards

Author Revealed upon completion

Vulnerability Details

Currently, the delegateBoost function in the BoostController is designed to delegate boost from one user to a pool, but it lacks validation to see whether the address to be delegated to is a supported pool:

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
@> if (to == address(0)) revert InvalidPool(); // missing check for supported pools
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();

The boost should only be allowed to be delegated to supported pools. As any address can be passed as to, two potential issues can happen here:

User delegates the funds to an untrusted entity and loses the funds or

User with X veTokens can create an infinite chain of delegations, i,e: A -> B -> C -> D -> E -> F.

Each step in the chain creates new boost power, when the original delegation expires, the chain remains active, which can lead to infinite boost multiplication.

ps: There is another issue here which is tracking the delegated amount, but this was sent in a different report.

Impact

  • Loss of funds for the user when the address is not from a supported pool.

  • Steal of boost rewards by creating a large chain of delegations.

Tools Used

Manual Review

Recommendations

Include the pool validation.

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
+ if (!supportedPools[to]) revert PoolNotSupported();
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 8 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks supported pool validation, allowing delegation to arbitrary addresses

inallhonesty Lead Judge 8 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks supported pool validation, allowing delegation to arbitrary addresses

Appeal created

Hawk 1 Submitter
7 days ago
inallhonesty Lead Judge
6 days ago

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.