Core Contracts

Summary

A vulnerability was identified in the removeBoostDelegation function, where the function incorrectly retrieves pool boost information using msg.sender instead of the actual pool address. This results in an unintended zeroing of values, leading to incorrect boost calculations and an inconsistent contract state.

Vulnerability Details

The function retrieves the PoolBoost struct using poolBoosts[msg.sender], assuming that msg.sender represents the pool address. However, msg.sender in this context is the user calling the function, not the pool itself. Consequently, poolBoosts[msg.sender] returns a zero-initialized PoolBoost struct, and any updates made to totalBoost and workingSupply are ineffective since they do not reference the correct pool.

Affected code: BoostController::removeDelegation

Impact

This flaw leads to:

• Incorrect accounting of totalBoost and workingSupply, rendering boost calculations state to be incorrect.

• A state inconsistency where delegations are removed but the pool’s boost data remains incorrect.

Tools Used

• Manual code review

Recommendations

• Replace poolBoosts[msg.sender] with poolBoosts[pool] to ensure the correct pool's boost data is updated.