Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Boost Multiplier Calculation

0x0107

Summary

The function getBoostMultiplier() calculates the boost multiplier incorrectly, leading to inflated or inaccurate multipliers. This could result in users receiving an unfair advantage or the system failing to distribute boosts correctly.

Vulnerability Details

Vulnerable Code:

function getBoostMultiplier(
address user,
address pool
) external view override returns (uint256) {
if (!supportedPools[pool]) revert PoolNotSupported();
UserBoost storage userBoost = userBoosts[user][pool];
if (userBoost.amount == 0) return MIN_BOOST;
​
uint256 baseAmount = userBoost.amount * 10000 / MAX_BOOST;
return userBoost.amount * 10000 / baseAmount; // ❌ Incorrect multiplier calculation
}
​

Problems:

  • The denominator baseAmount is calculated as

    userBoost.amount * 10000 / MAX_BOOST

  • If userBoost.amount is less than MAX_BOOST, baseAmount will be too small, leading to inflated multipliers.

  • This could cause unexpected results where users get higher boosts than they should.

  • The formula does not properly scale the boost multiplier, making it inconsistent across different boost amounts.

Poc

1.Assume MAX_BOOST = 25000, and a user has userBoost.amount = 5000.

2.The function calculates baseAmount incorrectly.

baseAmount = 5000 * 10000 / 25000; // = 2000

3.Now, it calculates the multiplier:

return 5000 * 10000 / 2000; // = 25000 (Incorrect!)

4.Instead of a correct multiplier, the user gets the maximum boost unexpectedly.

Impact

  • Boost multipliers can be unfairly inflated, leading to imbalance in voting power.

  • Users could unintentionally receive more boost than intended.

  • Fix ensures correct multiplier scaling, preventing abuse.

Tools Used

Manual Review, Hardhat

Recommendations

Instead of computing a dynamic denominator, normalize the multiplier against MAX_BOOST

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::getBoostMultiplier always returns MAX_BOOST for any non-zero boost due to mathematical calculation error, defeating the incentive mechanism

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.