Core Contracts

Summary

In BoostController.sol , users are allowed to delegate more boost than they own. This could lead to an inflation of delegated boost values, resulting in unintended consequences within the system.

Vulnerability Details

The contract fails to properly enforce a limit on the amount of boost a user can delegate. While it ensures that a user cannot delegate boost more than one time to a single recipient, it does not prevent them from delegating the boost multiple times to different recipients, because every time uses the veToken balance of msg.sender .

1. Users can delegate more boost than they actually have, leading to an inflated total boost supply.

2. The contract does not deduct the delegated amount from the sender's available boost, allowing for unlimited delegations.

Impact

1. Users can manipulate the boost distribution by delegating far beyond their actual balance.

2. Some users may receive an unfair amount of boost, affecting protocol fairness.

PoC

1. Assume the attacker has 100 veTokens available for delegation.
   The contract checks if the user has sufficient veTokens before delegating but does not deduct delegated amounts from the available balance.

2. The attacker starts by delegating boost to Victim A.
   Instead of being limited by their total balance, the attacker repeats the delegation to multiple addresses (Victim B, Victim C, etc.).
   Since the contract does not track already delegated boost, the attacker effectively delegates unlimited boost without restriction.

3. The protocol now has an inflated boost supply, as multiple users receive significant amounts of boost that should not exist.
   The attacker can favor certain users or manipulate the distribution of boost in a way that was not intended.

Tools Used

Manual review

Recommendations

Enforce a Global Boost Limit:

• Ensure that the total delegated boost cannot exceed the user's actual boost balance.

• Deduct delegated boost from the sender’s available boost upon delegation or provide a new variable that will account for the delegated boost.

Modify delegateBoost to Track and Reduce Sender’s Boost:

• Before delegating, check the user's total remaining boost.

• Subtract the delegated amount from the user's available boost to prevent multiple delegations of the same amount.