Unlimited Boost Delegation Allows Potential Exploitation
Summary
The delegateBoost function allows users to delegate boosts to multiple different addresses without restriction. This could lead to manipulation of rewards or governance mechanisms, increased storage costs, and potential system abuse.
Vulnerability Details
The contract's delegateBoost function does not enforce a limit on the number of different addresses a user can delegate to.
This means the function only prevents multiple delegations to the same address, but a user can delegate to an unlimited number of different addresses. this will allow a user could distribute small amounts of boosts across many addresses to manipulate reward distributions or governance voting power.
Impact
Users could distribute boosts enough times to influence incentives, governance, or reward calculations unfairly.
Tools Used
Manual Review
Recommendations
Consider tracking the amount being delegated by the user and checking with the users balance each time.
Lead Judging Commences
BoostController::delegateBoost lacks total delegation tracking, allowing users to delegate the same veTokens multiple times to different pools for amplified influence and rewards
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.