Core Contracts

Summary

BoostControllerenables third parties to boost "pools"/users based on the veToken balance of the caller or from address. Although there is a lack of access control that allows anyone to manipulate "pools" boost, functions like BoostController::updateUserBoost& BoostController::calculateBoostat least check if the pool is valid and whitelisted. However, this is not the case for the BoostController::delegateBoostfunction.

Vulnerability Details

The BoostController::delegateBoostfunction allows anyone to call it and delegate a boost to any address, allowed or not to receive a boost. As we can see (here)[https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/boost/BoostController.sol#L212-L235]. The only check is to ensure the input is not the address(0).

On the other hand, the value delegated is never added to the poolsBoost mapping. And never accounted for the BoostController::getPoolBoost, for example. But it is still updated on the userBoosts.

PS: The protocol documentation states: (Pool must be supported for boost operations)[https://docs.raac.io/core/governance/boost/BoostController]

Impact

The delegated boost is used on calculations on (getWorkingBalance())[], and (getBoostMultiplier())[] leading to wrong calculations results.

Tools Used

Code Review

Recommendations

Make the code consistent by adding a check on BoostController::delegateBoostor removing it from the other functions.