Core Contracts

Summary

There is no check to prevent disabling pools with active boosts, which could make existing user boosts inaccessible

Vulnerability Details

function modifySupportedPool(address pool, bool isSupported) external onlyRole(MANAGER_ROLE)

{
if (pool == address(0)) revert InvalidPool();

if (supportedPools[pool] == isSupported) revert PoolNotSupported();

supportedPools[pool] = isSupported;
if (isSupported) {
emit PoolAdded(pool);

} else {
emit PoolRemoved(pool);
}
}

Impact

Tools Used

Recommendations

require(poolBoosts[pool].totalBoost == 0, "Pool has active boosts");