Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

MAX_BOOST Is Wrongly Used

ChainDefenders

Summary

In the BoostController.sol contract the MAX_BOOST constant is used instead of the boostState.maxBoost variable when calculating boost through _calculateBoost, which can lead to incorrect boost calculations if the maximum boost value is updated.

Vulnerability Details

The vulnerability arises from the use of the MAX_BOOST constant in the _calculateBoost function. The MAX_BOOST constant represents the default maximum boost value, but the actual maximum boost value can be updated and stored in the boostState.maxBoost variable. By using the constant instead of the variable, the function may calculate incorrect boost amounts if the maximum boost value has been changed.

Impact

If the maximum boost value is updated, the _calculateBoost function will continue to use the outdated MAX_BOOST constant, leading to incorrect boost calculations. This can result in users receiving higher or lower boosts than intended, affecting the fairness and accuracy of the boost system. Over time, this can undermine user trust and the integrity of the protocol.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, replace the use of the MAX_BOOST constant with the boostState.maxBoost variable in the _calculateBoost function. Here is an example of how to implement this:

function _calculateBoost(
address user,
address pool,
uint256 amount
) internal view returns (uint256) {
if (amount == 0) revert InvalidBoostAmount();
if (!supportedPools[pool]) revert PoolNotSupported();
// Get current weights without modifying state
(uint256 totalWeight, uint256 totalVotingPower, uint256 votingPower) = updateTotalWeight();
uint256 userBalance = IERC20(address(veToken)).balanceOf(user);
uint256 totalSupply = IERC20(address(veToken)).totalSupply();
if (userBalance == 0 || totalSupply == 0) {
return amount;
}
// Create parameters struct for calculation
BoostCalculator.BoostParameters memory params = BoostCalculator.BoostParameters({
maxBoost: boostState.maxBoost,
minBoost: boostState.minBoost,
boostWindow: boostState.boostWindow,
totalWeight: totalWeight,
totalVotingPower: totalVotingPower,
votingPower: votingPower
});
(uint256 boostBasisPoints, uint256 boostedAmount) = BoostCalculator.calculateTimeWeightedBoost(
params,
userBalance,
totalSupply,
amount
);
​
if (boostedAmount < amount) {
return amount;
}
uint256 maxBoostAmount = amount * boostState.maxBoost / 10000;
if (boostedAmount > maxBoostAmount) {
return maxBoostAmount;
}
return boostedAmount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!