Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Users can `delegateBoost` to as many addresses as they want

pyro

Summary

Users can delegateBoost to as many addresses as they want, increasing their boost by a lot

Vulnerability Details

Currently delegateBoost does not work due to another issue, however in the case where the previous bug was removed this new vulnerability would appear.

delegateBoost does not decrease user balances or forbid multiple delegations

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/governance/boost/BoostController.sol#L212

function delegateBoost( ... ) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
​
// 7 days <= duration <= 365 days
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
​
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
​
UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
​
emit BoostDelegated(msg.sender, to, amount, duration);
}

This means that 1 user can delegate to a lot and increase their boost by a lot.

Impact

One user can delegate to as many as wants and increase their boost so they will earn more rewards without having any boost of their own
He can do it with his alt accounts, friends or a small community that stake altogether in a contract and increase each staker's boost by the total.

All of the aforementioned practices will be more rewarding if 1 user with a ton of boost boosts other with 0 boost, instead of all of them having small boosts on their own.

Tools Used

Manual review

Recommendations

Forbid users from boosting more than 1 account,or take tokens on delegateBoost in order to prevent such exploits.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks total delegation tracking, allowing users to delegate the same veTokens multiple times to different pools for amplified influence and rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!