Submission Details
Severity:
delegateBoost set user token balance amount to current boost amount
Summary
Incorrect set parameters in delegateBoost . So attacker able to set current boost amount to MAX_BOOST.
Vulnerability Details
Here its checked amount with user balance which is wrong comparison. since amount is the boost amount. Valid range for amount is MIN_BOOST(10000) to MAX_BOOST(25000). So attacker able to set MAX_BOOST for his boost amount.
function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
emit BoostDelegated(msg.sender, to, amount, duration);
}
Impact
Attacker able to set his boost amount as large number.
Tools Used
Manual Review
Recommendations
amount should be the in boost amount rather user balance amount. Also validate this to address as supporing pool address.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.