Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Unlimited boost delegation

falendar

Summary

The BoostController contract allows users to delegate boost unlimited times by using different target addresses.

Vulnerability Details

Any user with enough veToken balance can delegate max boost to any address.

Example:

  1. Bob sets 25,000 for amount (having enough veToken)

  2. Bob delegates max boost to any address repeatedly (possible once per address)

  3. Bob delegates to his own address

  4. Each address Bob delegates to receives a 2.5x boost multiplier

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
> UserBoost storage delegation = userBoosts[msg.sender][to];
> if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
emit BoostDelegated(msg.sender, to, amount, duration);
}

Impact

High: Boost power inflation through unlimited delegation to multiple addresses.

Recommendations

The provided documentation does not cover delegation limits. However, delegating max boost to unlimited number of addresses should not be possible. Consider implementing delegation limits and tracking delegated amounts.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks total delegation tracking, allowing users to delegate the same veTokens multiple times to different pools for amplified influence and rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.