Submission Details
Severity:
Lack of check supported pool in BoostController#removeBoostDelegation()
Summary
Unsupported pool can call this function to remove boost.
Vulnerability Details
Once the pool's status is modified by modifySupportedPool(), this pool can't work.
In removeBoostDelegation(), there's missing supportedPools[msg.sender] validation. So unspported pool can call removeBoostDelegation(), allowing them to revoke delegations unfairly.
Impact
Logic error
Tools Used
manual
Recommendations
Add a validation check at the beginning of removeBoostDelegation():
if (!supportedPools[msg.sender]) revert PoolNotSupported();
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.