In the updateUserBoost
function, workingSupply
should represent the sum of all user boosts in the pool. Instead, it’s set to the latest user’s boost amount, discarding previous contributions.
The userBoosts
mapping stores each user's boost individually, per pool. However, the poolBoost.workingSupply
is incorrectly being overwritten with the latest user's boost, disregarding all prior contributions.
POC
I created a Test using below scenario's to back my claim:
Add a supported pool.
User1 updates their boost to 100.
User2 updates their boost to 200.
Verify the pool’s workingSupply is 300 (100 + 200).
Test Result
The workingSupply
is overwritten to 200
(User2’s boost) instead of accumulating to 300
.
If the workingSupply is incorrect, reward distributions will be miscalculated. Users might get more or less than they deserve, depending on the order of updates. This undermines the trust in the protocol's fairness.
Using the POC above, If the pool has 300 total boosted tokens but workingSupply shows 200, rewards will be distributed as if there are only 200 tokens.
Update workingSupply to accumulate boosts instead of overwriting:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.
The contest is complete and the rewards are being distributed.