Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Working Supply Calculation

kwakudr

Summary

updateUserBoost overwrites poolBoost.workingSupply with the user's new boost instead of accumulating it, leading to incorrect totals.

Vulnerability Details

function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
if (paused()) revert EmergencyPaused();
if (user == address(0)) revert InvalidPool();
if (!supportedPools[pool]) revert PoolNotSupported();
UserBoost storage userBoost = userBoosts[user][pool];
PoolBoost storage poolBoost = poolBoosts[pool];
uint256 oldBoost = userBoost.amount;
// Calculate new boost based on current veToken balance
uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
userBoost.amount = newBoost;
userBoost.lastUpdateTime = block.timestamp;
// Update pool totals safely
if (newBoost >= oldBoost) {
poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
} else {
poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
}
poolBoost.workingSupply = newBoost; // Set working supply directly to new boost
poolBoost.lastUpdateTime = block.timestamp;
emit BoostUpdated(user, pool, newBoost);
emit PoolBoostUpdated(pool, poolBoost.totalBoost, poolBoost.workingSupply);
}
// In updateUserBoost():
poolBoost.workingSupply = newBoost; // Set working supply directly to new boost

The code replaces the entire pool's working supply with a single user's boost amount. Previous contributions from other users in the pool are erased. Creates false representation of total boosted liquidity in the pool.

Example Scenario

Initial state:

  • User1 boost: 1000

  • User2 boost: 1500

  • Working supply should be: 2500

User1 updates boost to 1200:

  • Current code sets working supply = 1200 //incorrect

  • Correct working supply should be: 2500 - 1000 + 1200 = 2700

User2 now updates boost:

  • Working supply would start from 1200 instead of 2700

  • Permanent loss of 1500 from User2's previous boost

Impact

Permanent lossof user's boost from previous boost. Reward shares calculations will be incorrect

Tools Used

Foundry

Recommendations

Adjust workingSupply by the difference between new and old boosts.

poolBoost.workingSupply += (newBoost - oldBoost);
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost overwrites workingSupply with single user's boost value instead of accumulating, breaking reward multipliers and allowing last updater to capture all benefits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!