Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

The calculation in calculateBoost() are not correct in BoostCalculator.sol

BBnDD

Summary

The calculation in calculateBoost() are not correct in BoostCalculator.sol

Vulnerability Details

In the documentation of RAAC protocol it is stated that -> The BoostController is designed to manage boost calculations and delegations for the protocol. It implements Curve-style boost mechanics with configurable multipliers and supports pool-specific boost management.

However, it doesn't implements the Curve-style boost mechanics and calculations.

This is the documentation of Curve Finance->

B has a maximum of 2.5 so if the formula gives a value greater than 2.5 then your boost is 2.5.

B=1.5×((D×v)/(V×d))+1

Where:

  • B is your rewards boost (if it's more than 2.5 it just equals 2.5).

  • d is the value you deposit, in USD.

  • D is the total value deposited to the pool's reward gauge, in USD.

  • v is the amount of veCRV you have (vote weight).

  • V is the total veCRV in the system (total vote weight) click here to find the current amount.

But in the RAAC protocol in the calculateBoost the formula is different ->

function calculateBoost(uint256 veBalance,uint256 totalVeSupply,BoostParameters memory params) internal pure returns (uint256) {
// Return base boost (1x = 10000 basis points) if no voting power
if (totalVeSupply == 0) {
return params.minBoost;
}
​
​
// Calculate voting power ratio with higher precision
uint256 votingPowerRatio = (veBalance * 1e18) / totalVeSupply;
// Calculate boost within min-max range
uint256 boostRange = params.maxBoost - params.minBoost;
uint256 boost = params.minBoost + ((votingPowerRatio * boostRange) / 1e18);
// Ensure boost is within bounds
if (boost < params.minBoost) {
return params.minBoost;
}
if (boost > params.maxBoost) {
return params.maxBoost;
}
return boost;
}

as we can see the calculation is not using the tokens that the users staked neither the total staked tokens.

This means that the boost calculation is only increased via the voting power.

Impact

Incorrect calculations

Tools Used

Recommendations

the calculation of the boost variable should look like

boost = 1.5 * ((totalStakedSupply * veBalance) / (totalVeSupply * staked)) + 1

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.