Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

veToken lock duration not enforced in boost delegation

0xyashar

Summary

Users can delegate their boost to another address even when the lock duration of their veToken has expired and the tokens can be withdrawn. This results in a delegation occurring when no veTokens are actually locked.

Vulnerability Details

In BoostController.sol::delegateBoost, users must specify the duration for which they want their boosts to be delegated to another address. Additionally, the delegated amount cannot exceed the user's veToken balance.

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
=> uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
=> if (userBalance < amount) revert InsufficientVeBalance();
UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
=> delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
emit BoostDelegated(msg.sender, to, amount, duration);
}

As shown above, delegateBoost only verifies the user's current veToken balance but does not check whether an active lock exists for the user. This allows users with expired locks to call delegateBoost and then immediately call withdraw and withdraw their RAACTokens, effectively delegating boosts without actually maintaining any active locks in veRAACToken.sol.

Impact

Users can delegate boosts without having any active veToken locks, which can lead to unintended or fraudulent boost allocations.

Tools Used

Manual Review

Recommendations

Check the lock duration of the veToken before allowing users to delegate. Ensure that the delegation duration does not exceed the remaining lock duration of the veToken.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController delegations remain valid even when users withdraw their veRAAC tokens, allowing boost "double-spending" and undermining the economic model requiring locked tokens

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController delegations remain valid even when users withdraw their veRAAC tokens, allowing boost "double-spending" and undermining the economic model requiring locked tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.