Submission Details
Severity:
`poolBoosts` in BoostController contract is never updated in `delegateBoost` while it should
Summary
poolBoosts storage mapping is used to map pool addresses to their boost information.
/// @notice Maps pool addresses to their boost information
mapping(address => PoolBoost) private poolBoosts; // pool => boost
This mapping is currently updated in 2 functions: updateUserBoost and removeBoostDelegation.
The problem arises because delegateBoost doesn't update this variable while it should.
Overall, its unclear how poolBoost should work.
Impact
The impact of this issue is high as currently, boost and poolBoost logic is broken.
Tools Used
Manual review.
Recommendations
Make sure to clarify in documentation how boosts should work and correctly implement it.
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
BoostController removes pool boost on delegation removal without adding it on delegation creation, leading to accounting inconsistencies and potential underflows
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
BoostController removes pool boost on delegation removal without adding it on delegation creation, leading to accounting inconsistencies and potential underflows
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.