Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

No incentive to call BoostController::removeBoostDelegation()

iso

Summary

The protocol has a feature, which allows users to delegate their boost to another address.

This logic is facilitated by two functions: delegateBoost() and removeBoostDelegation()

The delegateBoost() only allows one delegation at a time and will revert until the amount value is reset by calling removeBoostDelegation().

Vulnerability Details

The issue is removeBoostDelegation() can only be called by the recipient of the delegation.

If the recipient turns malicious, they can permanently DoS the delegator from using the delegation feature again by not calling removeBoostDelegation() even after expiry.

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
// SNIP
UserBoost storage delegation = userBoosts[msg.sender][to];
> if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
emit BoostDelegated(msg.sender, to, amount, duration);
}
function removeBoostDelegation(address from) external override nonReentrant {
> UserBoost storage delegation = userBoosts[from][msg.sender];
> if (delegation.delegatedTo != msg.sender) revert DelegationNotFound();
// SNIP
emit DelegationRemoved(from, msg.sender, delegation.amount);
> delete userBoosts[from][msg.sender];
}
​

Impact

Permanent DoS of delegateBoost() for affected users

Tools Used

Manual Review

Recommendations

Modify removeBoostDelegation() to be callable by both the delegator as well the recipient so that the delegation can be reset if the recipient goes missing or malicious.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController: Users unable to remove their own expired boost delegations, creating dependency on recipients and preventing efficient reallocation of boosts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.