Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

poolBoost.totalBoost is incorrectly updated in BoostController due to hardcoded base amount

h2134

Summary

poolBoost.totalBoost is incorrectly updated in BoostController due to hardcoded base amount.

Vulnerability Details

In BoostController, updateUserBoost() is called to update the boost value for a user in a specific pool, and poolBoost.totalBoost is updated based on user's oldBoost and newBoost.

BoostController::updateUserBoost()

@> uint256 oldBoost = userBoost.amount;
// Calculate new boost based on current veToken balance
@> uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
userBoost.amount = newBoost;
userBoost.lastUpdateTime = block.timestamp;
// Update pool totals safely
if (newBoost >= oldBoost) {
@> poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
} else {
@> poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
}

User's boot is returned by _calculateBoost(), this function calculates boot for a user based on base amount.

BoostController::_calculateBoost()

(uint256 boostBasisPoints, uint256 boostedAmount) = BoostCalculator.calculateTimeWeightedBoost(
params,
userBalance,
totalSupply,
amount
);
​
if (boostedAmount < amount) {
return amount;
}
uint256 maxBoostAmount = amount * MAX_BOOST / 10000;
if (boostedAmount > maxBoostAmount) {
return maxBoostAmount;
}
return boostedAmount;

The problem is that when _calculateBoost() is called in updateUserBoost(), the base amount is hardcoded to 10000, results in a user's boost amount is always between [10000, 25000], even if the user holds no veRAAC tokens.

// Calculate new boost based on current veToken balance
uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount

As a result, poolBoost.totalBoost is incorrectly updated.

Impact

poolBoost.totalBoost is wrongly updated, this may result in user receive incorrectly pool yieldings.

Tools Used

Manual Review

Recommendations

User boost amount should be calculated based on the user's veToken balance.

// Calculate new boost based on current veToken balance
- uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
+ uint256 newBoost = _calculateBoost(user, pool, IERC20(address(veToken)).balanceOf(user)); // Base amount
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost uses hardcoded 10000 base amount, storing basis points instead of actual boosted amount

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost uses hardcoded 10000 base amount, storing basis points instead of actual boosted amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.