Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Expired delegations remain active until recipients call removeBoostDelegation, which they may never do.

0x23r0

Summary

In the BoostController contract its boost delegation mechanism where expired delegations remain active until manually revoked by delegation recipients. This design oversight allows inactive boosts to perpetually influence pool metrics, resulting in inaccurate reward calculations and potential unfair advantage in reward distribution.

Vulnerability Details

  1. Passive Expiration Handling:

    • Delegated boosts (via delegateBoost()) persist indefinitely after expiration until recipients actively call removeBoostDelegation().

    • The updateUserBoost() function recalculates user boosts without checking delegation expiration status, leaving stale delegations active.

  2. State Corruption in Pool Metrics:

    • Expired delegations continue to inflate poolBoosts[pool].totalBoost and poolBoosts[pool].workingSupply values.

    • These corrupted metrics are used in reward calculations, creating systemic inaccuracies.

function removeBoostDelegation(address from) external override nonReentrant {
UserBoost storage delegation = userBoosts[from][msg.sender];
if (delegation.delegatedTo != msg.sender) revert DelegationNotFound();
@>> if (delegation.expiry > block.timestamp) revert InvalidDelegationDuration();
// Update pool boost totals before removing delegation
PoolBoost storage poolBoost = poolBoosts[msg.sender];
if (poolBoost.totalBoost >= delegation.amount) {
poolBoost.totalBoost -= delegation.amount;
}
if (poolBoost.workingSupply >= delegation.amount) {
poolBoost.workingSupply -= delegation.amount;
}
poolBoost.lastUpdateTime = block.timestamp;
emit DelegationRemoved(from, msg.sender, delegation.amount);
delete userBoosts[from][msg.sender];
}

When delegations expire (block.timestamp >= delegation.expiry), no automatic mechanisms adjust pool totals.The removeBoostDelegation() function is permissioned to delegation recipients, creating reliance on third-party actions. critical state-updating functions (updateUserBoost(), getWorkingBalance()) fail to validate delegation expiration status during routine operations.

Impact

Stale boosts artificially increase pool metrics, enabling unfair reward claims.

Tools Used

Manual Review

Recommendations

Add expiration timestamp validation in all boost calculation entry points

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController: Users unable to remove their own expired boost delegations, creating dependency on recipients and preventing efficient reallocation of boosts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!