Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`BoostController::delegateBoost` doesn't check for allow "pool" before delegating, and the delegated value is still used on calculations

77SecMentees

Summary

BoostControllerenables third parties to boost "pools"/users based on the veToken balance of the caller or from address. Although there is a lack of access control that allows anyone to manipulate "pools" boost, functions like BoostController::updateUserBoost& BoostController::calculateBoostat least check if the pool is valid and whitelisted. However, this is not the case for the BoostController::delegateBoostfunction.

Vulnerability Details

The BoostController::delegateBoostfunction allows anyone to call it and delegate a boost to any address, allowed or not to receive a boost. As we can see (here)[https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/boost/BoostController.sol#L212-L235]. The only check is to ensure the input is not the address(0).

On the other hand, the value delegated is never added to the poolsBoost mapping. And never accounted for the BoostController::getPoolBoost, for example. But it is still updated on the userBoosts.

function test_delegateBoostDoesntCheckWhitelistedBoosts() external {
//Mock values needed
address receiver = address(1);
uint256 boostAmountToBeMinted = 100_000 *10**18;
uint256 timeLock = 365 days;
uint256 duration = 7 days;
​
//Mint RAACTokens to lock
vm.prank(s_admin);
s_raacToken.mint(s_user01, boostAmountToBeMinted);
​
//Lock veRAACToken to delegate boost
vm.startPrank(s_user01);
s_raacToken.approve(address(s_veToken), boostAmountToBeMinted);
s_veToken.lock(boostAmountToBeMinted, timeLock);
​
//Get total veToken received
uint256 veTokenBalance = s_veToken.balanceOf(s_user01);
​
//Delegate Boost - arbitrary "pool/receiver"
vm.expectRevert();
s_boostController.delegateBoost(receiver, veTokenBalance, duration);
}

PS: The protocol documentation states: (Pool must be supported for boost operations)[https://docs.raac.io/core/governance/boost/BoostController]

Impact

The delegated boost is used on calculations on (getWorkingBalance())[], and (getBoostMultiplier())[] leading to wrong calculations results.

Tools Used

Code Review

Recommendations

Make the code consistent by adding a check on BoostController::delegateBoostor removing it from the other functions.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks supported pool validation, allowing delegation to arbitrary addresses

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks supported pool validation, allowing delegation to arbitrary addresses

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.