Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Boost delegation will not work because `userBoosts` is updated incorrectly when delegating boosts

greese

Summary

When a user wishes to delegate their boost to another user, their corresponding userBoosts mapping is updated. The issue is the delegation functions update the pool address in the mapping to the user they are delegating to so the corresponding pool they are receiving a boost for will be lost.

Vulnerability Details

A user chooses to delegate their boost to another user and calls delegateBoost. The delegation storage variable is initialized with the msg.sender and to parameter. The problem is this to parameter that is supposed to represent who the user is delegating to actually is in the spot in the mapping where the pool address should be.

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
@> UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
emit BoostDelegated(msg.sender, to, amount, duration);
}

If we look at how the userBoosts variable is declared, we can see the intended behavior.

// @notice Maps user addresses to their boost information for each pool
mapping(address => mapping(address => UserBoost)) private userBoosts; // user => pool => boost

Impact

Unable to delegate boost to a user for a given pool

Tools Used

Manual Review

Recommendations

There doesnt need to be a new UserBoost mapping created. There is already a delegatedTo variable as part of the UserBoost object.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController's delegation system fundamentally broken due to missing pool associations, treating recipient addresses as pools and never properly updating pool boost metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!