Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

The updateTotalWeight return incorrect values leading to updating the state with incorrect values

ChainProof

Summary

The updateTotalWeight returns incorrect values due to veTokens not being transferrable .

Vulnerability Details

When calculating boost , the updateWeight gets called to calculate the current weight without modifying the state

function calculateBoost(
address user,
address pool,
uint256 amount
) external view override returns (uint256 boostBasisPoints, uint256 boostedAmount) {
if (!supportedPools[pool]) revert UnsupportedPool();
// Get current weights without modifying state
@> (uint256 totalWeight, uint256 totalVotingPower, uint256 votingPower) = updateTotalWeight();
uint256 userVotingPower = veToken.getVotingPower(user, block.timestamp);
// Create parameters struct for calculation
BoostCalculator.BoostParameters memory params = BoostCalculator.BoostParameters({
maxBoost: boostState.maxBoost,
minBoost: boostState.minBoost,
boostWindow: boostState.boostWindow,
@> totalWeight: totalWeight,
totalVotingPower: totalVotingPower,
@> votingPower: votingPower
});
return BoostCalculator.calculateTimeWeightedBoost(
params,
userVotingPower,
totalVotingPower,
amount
);
}

The issue with this is that, the veToken is a non-transferrable token, meaning the token after minting cannot be transferred, but the updateTotalWeight is returning the locked position of address(this), meaning the boostController address, but the veTokens are never minted to the boostController contract , meaning , it would always return zero.

Impact

The boostParameters are incorrectly applied, this will lead to an incorrect state like the totalWeight and the votingPower.

Tools Used

Manual

Recommendations

Make the function to return that for a specific address that has veTokens and not the boostController which has no veTokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateTotalWeight queries its own nonexistent lock position and voting power when calculating boosts, resulting in zero values that break all boost calculations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.