Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

DelegateBoost balances not updated properly lead to user being able to use the same amount for double the rewards

buggsyes

Summary

delegateBoost does not reset/deduct balances of the user that delegates so he can delegate to another address and effectively getting double the reward and vote boost for the same
balance of tokens .

Vulnerability Details

malicious user can delegate his boosted amount to another address and his balance is not deducted , making it possible to delegate his amount and for him to use it aswell
gaming the protocol to receive double the rewards.
only delegation.amount is being recorded and checked if there is any delegated before this call with :
UserBoost storage delegation = userBoosts[msg.sender][to]; if (delegation.amount > 0) revert BoostAlreadyDelegated(); .

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
​
> missing balance deduction for the send amount for msg.sender
delegation.amount = amount; // nowhere the boost is deducted from my account , so i can use the same amount of Vetokens to delegate to people and influence rewards and voting power
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
emit BoostDelegated(msg.sender, to, amount, duration);
}

Impact

malicious user can use the same amount of tokens to receive double the rewards and voting power delegating it to another address of his own.

Tools Used

manual review

Recommendations

deduct balances of msg.sender with the corresponding amount that is being delegated.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks total delegation tracking, allowing users to delegate the same veTokens multiple times to different pools for amplified influence and rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!