Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing integration with `BoostController`

falendar

Summary

The protocol has competing boost calculation implementations, with BaseGauge and veRAACToken bypassing the intended BoostController architecture.

Vulnerability Details

The BoostController contract is designed to manage protocol-wide boost mechanics including user boost delegations, pool-specific boost tracking, and boost calculations. However, BaseGauge and veRAACToken bypass this intended architecture by calculating boosts independently, not respecting delegated boost and ignoring specific boost states.

Example in BaseGauge:

function _applyBoost(address account, uint256 baseWeight) internal view virtual returns (uint256) {
if (baseWeight == 0) return 0;
IERC20 veToken = IERC20(IGaugeController(controller).veRAACToken());
uint256 veBalance = veToken.balanceOf(account);
uint256 totalVeSupply = veToken.totalSupply();
​
// Create BoostParameters struct from boostState
BoostCalculator.BoostParameters memory params = BoostCalculator.BoostParameters({
maxBoost: boostState.maxBoost,
minBoost: boostState.minBoost,
boostWindow: boostState.boostWindow,
totalWeight: boostState.totalWeight,
totalVotingPower: boostState.totalVotingPower,
votingPower: boostState.votingPower
});
​
> uint256 boost = BoostCalculator.calculateBoost(
veBalance,
totalVeSupply,
params
);
return (baseWeight * boost) / 1e18;
}

veRAACToken maintains its own boost state:

BoostCalculator.BoostState private _boostState;

Impact

High: No contract integrates with BoostController's systems, which breaks the boost mechanics.

Recommendations

Consider consolidating all boost logic in BoostController, removing duplicate boost implementations and updating all contracts to use BoostController.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol contains competing boost calculation implementations in different contracts that bypass each other, creating inconsistent rewards and breaking delegation mechanics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.