Core Contracts

Summary

The updateUserBoost function directly sets the workingSupply to the newly calculated boost value, which can lead to inconsistencies between workingSupply and totalBoost. When a user interacts with a supported pool for the first time, the newBoost can return a high default value (e.g., 10000), causing the workingSupply to be incorrectly inflated.

Vulnerability Details

When the function is called under these conditions:

• The user has never interacted with the specified pool (userBoost.amount defaults to 0).

• The pool is already supported and has an existing poolBoost state.

The newBoost calculation can return a high value (e.g., 10000) due to the default veToken calculation logic. This value is then directly assigned to poolBoost.workingSupply without considering the existing poolBoost.totalBoost.

Problematic Code Segment

Example Scenario

1. Initial State:

   • poolBoost.totalBoost = 10_000_000

   • poolBoost.workingSupply = 10_000_000

2. First-Time User Interaction:

   • oldBoost = 0 (user has no prior interaction)

   • newBoost = 10000 (from _calculateBoost)

   • poolBoost.totalBoost updates to 10_010_000 correctly.

   • However:

     poolBoost.workingSupply = newBoost; // Now set to 10,000 instead of maintaining the totalBoost-related proportion.

   • Result: workingSupply becomes 10,000, while totalBoost is 10,010,000, leading to data inconsistency.

Impact

• Data Inconsistency: workingSupply becomes lower than totalBoost, potentially affecting calculations relying on accurate supply metrics.

• Reward Distribution Errors: Misalignment between workingSupply and totalBoost can distort pool-based calculations, affecting user rewards and overall system integrity.

• Potential Manipulation: Malicious actors may exploit this to alter the working supply for personal gain.

Tools Used

Manual code review and logical analysis of state variable updates.

Recommendations

Update the assignment of workingSupply to reflect accumulated boosts rather than resetting it:

Suggested Fix

Instead of:

Use:

This ensures that workingSupply is incremented or decremented relative to the previous boost values, maintaining consistency with totalBoost.

Alternatively, if workingSupply should mirror totalBoost:

This ensures both metrics remain aligned and avoids potential data inconsistencies.