Summary

The removeBoostDelegation function in BoostController.sol is currently designed to:

• Only be called by the delegation recipient after expiry

• Remove expired boost delegations

• Update pool boost totals

• Delete the delegation mapping

Vulnerability Details

Notice in the snippet code below how the function is expected to be called by the pool.

UserBoost storage delegation = userBoosts[from][msg.sender];

In this case, it is impossible for a user or a pool to remove the boost delegation. For the user because userBoosts[from][msg.sender]will return an empty dictionary as the user address is not a pool.(This is also an issue confirmed by the sponsor and reported here.

The lack of an implementation to call removeBoostDelegation directly from the pools is confirmed by the sponsor:

Question: "Is a design choice to also allow the pool to remove the delegateBoost?"

Answer(by Alex Werner): "Yes, you are right, it appears that there is a missing implementation for the pool to do so."

Impact

• Users are prevented from redelegating boosts to more efficient pools after expiry.

• Pools will retain expired boost, directly affecting yield calculation and rewards distribution.

Tools Used

Manual Review

Recommendations

Implement on the Pool contracts a public function that calls BoostController.removeBoostDelegation so any user can remove the boost delegation of their funds from a pool.