Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect BoostController#_calculateBoost() base amount causes unintended boost fluctuations

newspacexyz

Summary

In BoostController#updateUserBoost(), the function incorrectly calls _calculateBoost(user, pool, 10000), using a fixed amount of 10,000 instead of the user’s actual previous boost amount. This can lead to arbitrary changes in user boost calculations, allowing users to gain or lose boost unintentionally.

Vulnerability Details

function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
if (paused()) revert EmergencyPaused();
if (user == address(0)) revert InvalidPool();
if (!supportedPools[pool]) revert PoolNotSupported();
UserBoost storage userBoost = userBoosts[user][pool];
PoolBoost storage poolBoost = poolBoosts[pool];
uint256 oldBoost = userBoost.amount;
// Calculate new boost based on current veToken balance
@> uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
userBoost.amount = newBoost;
...
}

_calculateBoost(user, pool, amount) returns amount * (boostState.minBoost + (boostState.maxBoost - boostState.minBoost) * userBalance / totalSupply)

So after updateUserBoost(), boost amount will be fixed. Since this function has no modifier, anyone can make other's boost amount fixed based on 10000.

For example, user's boost is only 1000 due to his balance is only 1000 and after updateUserBoost(), he will receive 10000 greater boost amount. In contrast 100000 boost degrade to 10000 boost.

Impact

Logic is broken and delegateBoost()'s amount argument is needless.

Incorrect calculations cause unintended boost changes.

Tools Used

manual

Recommendations

Use oldBoost Instead of a Fixed 10000

function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
...
uint256 oldBoost = userBoost.amount;
// Calculate new boost based on current veToken balance
- uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
+ uint256 newBoost = _calculateBoost(user, pool, oldBoost); // Base amount
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost uses hardcoded 10000 base amount, storing basis points instead of actual boosted amount

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost uses hardcoded 10000 base amount, storing basis points instead of actual boosted amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!