Core Contracts

Summary

MAX_BOOST is said to be 2.5x but allows for up to 5x.

Vulnerability Details

The documentation in the BoostController contract states that the maximum boost multiplier is 2.5x, as indicated by the MAX_BOOST constant set to 25000 basis points. However, the setBoostParameters() function allows setting a maximum boost multiplier up to 5x (50000 basis points). This discrepancy between the documentation and the actual functionality can lead to confusion and potential misuse of the contract.

The inconsistency is found in the following code snippet:

Impact

Undermines protocol integrity with code-docs Inconsistency.

Tools Used

Manual Review

Recommendations

To resolve this issue, ensure that the documentation accurately reflects the functionality of the contract. If the intention is to allow a maximum boost of 5x, update the documentation to reflect this. Alternatively, if the maximum boost should be limited to 2.5x, adjust the setBoostParameters() function to enforce this limit.