Core Contracts

Summary

When updating a user/pool boost, the pool's working supply is incorrectly overwritten.

Vulnerability Details

When users call updateUserBoost() in order to boost a pool, the function incorrectly overwrites the poolBoost.workingSupply variable:

This is incorrect since the workingSupply variable is supposed to track the "total working supply including boosts". And what the function does is just overwrite it with the newBoost amount which is the current user's boost amount. It should increment the variable with newBoost instead of overwrite it.

Impact

The poolBoost.workingSupply will never be correctly reflected since the value is overwritten on every new boost with only the current boosting user's newBoost amount. This will calculate the pool rewards boosts incorrectly.

Tools Used

Manual Review

Recommendations

Increment the working supply instead of overwriting it.