Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Wrong input param for `BoostCalculator.calculateTimeWeightedBoost()` inside `BoostController.sol::_calculateBoost` function.

orangesantra

Summary

Contract - BoostController.sol

Code snippet

function _calculateBoost(
address user,
address pool,
uint256 amount
) internal view returns (uint256) {
if (amount == 0) revert InvalidBoostAmount();
if (!supportedPools[pool]) revert PoolNotSupported();
// Get current weights without modifying state
(uint256 totalWeight, uint256 totalVotingPower, uint256 votingPower) = updateTotalWeight();
uint256 userBalance = IERC20(address(veToken)).balanceOf(user);
uint256 totalSupply = IERC20(address(veToken)).totalSupply();
if (userBalance == 0 || totalSupply == 0) {
return amount;
}
// Create parameters struct for calculation
BoostCalculator.BoostParameters memory params = BoostCalculator.BoostParameters({
maxBoost: boostState.maxBoost,
minBoost: boostState.minBoost,
boostWindow: boostState.boostWindow,
totalWeight: totalWeight,
totalVotingPower: totalVotingPower,
votingPower: votingPower
});
@ -> (uint256 boostBasisPoints, uint256 boostedAmount) = BoostCalculator.calculateTimeWeightedBoost(
params,
userBalance,
totalSupply,
amount
);
​
if (boostedAmount < amount) {
return amount;
}
uint256 maxBoostAmount = amount * MAX_BOOST / 10000;
if (boostedAmount > maxBoostAmount) {
return maxBoostAmount;
}
return boostedAmount;
}

the function selector of calaculateTimeWeightedBoost is as follow -

function calculateTimeWeightedBoost(
@ -> BoostState storage state,
uint256 userBalance,
uint256 totalSupply,
uint256 amount
)

It requires BoostState struct object as param, but in _calculateBoost the param injected for BoostCalculator.calculateTimeWeightedBoost is BoostParameters struct object.

Vulnerability Details

  1. User calls BoostController.sol::updateUserBoost().

  2. It will call internal function _calculateBoost; but it will revert due to wrong data type injection (described above).

Impact

DOS of function BoostController.sol::updateUserBoost(), whenever it's called.

Tools Used

Manual

Recommendations

Pass the correct param.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.