Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

User can delegate boost with holding no veRAAC tokens for the whole delegation duration

h2134

Summary

User can delegate boost with holding no veRAAC tokens for the whole delegation duration.

Vulnerability Details

When a user delegates boot to another address, protocol updates the delegation's expiry is set.

BoostController::delegateBoost()

delegation.amount = amount;
@> delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;

However, protocol does not check the expiry against the unlock time of user's lock position. A malicious user delegates by using veRAAC token balance minted from an expired lock, then immediately withdraw from veRAACToken and get the veRAAC tokens burned, as a result, the user delegates for a period without holding any veRAAC tokens.

Impact

User delegates without holding veRAAC tokens during the delegation period.

Tools Used

Manual Review

Recommendations

When a user delegates, should check the delegation's exipry date against the user's lock unlock time.

delegation.amount = amount;
+ if (block.timestamp + duration > lock.end) { revert; }
​
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController delegations remain valid even when users withdraw their veRAAC tokens, allowing boost "double-spending" and undermining the economic model requiring locked tokens

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController delegations remain valid even when users withdraw their veRAAC tokens, allowing boost "double-spending" and undermining the economic model requiring locked tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.