Submission Details
Severity:
`updateUserBoost` function in BoostController contract is never called by veRAACToken contract.
Summary
updateUserBoost function in BoostController contract is responsible for updating the boost associated with a user. This update should occur each time a user's lock is created or updated.
function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
if (paused()) revert EmergencyPaused();
if (user == address(0)) revert InvalidPool();
if (!supportedPools[pool]) revert PoolNotSupported();
UserBoost storage userBoost = userBoosts[user][pool];
PoolBoost storage poolBoost = poolBoosts[pool];
uint256 oldBoost = userBoost.amount;
// Calculate new boost based on current veToken balance
uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
userBoost.amount = newBoost;
userBoost.lastUpdateTime = block.timestamp;
// Update pool totals safely
if (newBoost >= oldBoost) {
poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
} else {
poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
}
poolBoost.workingSupply = newBoost; // Set working supply directly to new boost
poolBoost.lastUpdateTime = block.timestamp;
emit BoostUpdated(user, pool, newBoost);
emit PoolBoostUpdated(pool, poolBoost.totalBoost, poolBoost.workingSupply);
}
The problem arises because this function is never called by the veRAACToken contract, basically preventing all users from benefiting from the boosts.
Impact
The impact of this issue is high as it means no boosts are applied for veRAAC holders in the protocol.
Tools Used
Manual review
Recommendations
Make sure to integrate the BoostController contract in the veRAACToken contract to handle boosts computations.
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
Protocol contains competing boost calculation implementations in different contracts that bypass each other, creating inconsistent rewards and breaking delegation mechanics
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
Protocol contains competing boost calculation implementations in different contracts that bypass each other, creating inconsistent rewards and breaking delegation mechanics
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.