Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

UpdateTotalWeight gives wrong values for User Boost Calculations.

buggsyes

Summary

in function calculateBoost wrong values are being fetched from updateTotalWeight() to calculate the user's boost .

Vulnerability Details

calculateboost calls updateTotalWeight()to retrievetotalWeight totalVotingPower votingPower to pass for calculations of the user's boost amount

function calculateBoost(
address user,
address pool,
uint256 amount
) external view override returns (uint256 boostBasisPoints, uint256 boostedAmount) {
if (!supportedPools[pool]) revert UnsupportedPool();
// Get current weights without modifying state
(uint256 totalWeight, uint256 totalVotingPower, uint256 votingPower) = updateTotalWeight();
uint256 userVotingPower = veToken.getVotingPower(user, block.timestamp);
// Create parameters struct for calculation
BoostCalculator.BoostParameters memory params = BoostCalculator.BoostParameters({
maxBoost: boostState.maxBoost,
minBoost: boostState.minBoost,
boostWindow: boostState.boostWindow,
totalWeight: totalWeight,
totalVotingPower: totalVotingPower,
votingPower: votingPower
});
return BoostCalculator.calculateTimeWeightedBoost(
params,
userVotingPower,
totalVotingPower,
amount
);
}

the issue is that when it calls updateTotalWeight() , the function retrieves getLockPosition for address(this) same with getVotingPower which will not return the user's
lockPosition and votingPower , it will instead return the contract's balances that is calling it because its hardcoded to return information about address(this) in this case the BoostController.sol

function updateTotalWeight() internal view returns (uint256 totalWeight,uint256 totalVotingPower,uint256 votingPower) {
return (
veToken.getLockPosition(address(this)).amount,
veToken.getTotalVotingPower(),
veToken.getVotingPower(address(this), block.timestamp)
);
}

this will pass incorrect values for TotalVotingPower totalWeight,voting power for BoostCalculations.
in the call to updateTotalWeight i think its intention was to return totalWeight in the protocol but in this case it returns LockPosition for specific address as TotalWeight .

Impact

UpdateTotalWeight will return wrong values to _CalculateBoost which will lead to incorrect calculations of user boosts .

Tools Used

manual review

Recommendations

if you want to return totalWeight make a getter function and call it instead of getLockPosition.
instead of address this use the user address to fetch his needed balances .

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateTotalWeight queries its own nonexistent lock position and voting power when calculating boosts, resulting in zero values that break all boost calculations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!