Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Boost Delegation Can Be Performed to Self

pelz

Summary

The delegateBoost function does not prevent users from delegating boosts to themselves. This unintended behavior undermines the purpose of delegation and could lead to user confusion or abuse of boost tracking mechanisms.

Vulnerability Details

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
​
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
​
UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
​
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
​
emit BoostDelegated(msg.sender, to, amount, duration);
}

Issue

  • No check ensures to != msg.sender.

  • Users can delegate boosts to themselves, making the delegation process redundant.

  • May lead to misinterpretation of boosts or unnecessary state changes.

Impact

  • Redundant on-chain storage usage.

  • Possible confusion for users and front-end applications.

  • Potential for gaming certain calculations or reward mechanisms relying on boost delegation.

Tools Used

Manual code review.

Recommendations

Add a check to prevent self-delegation:

if (to == msg.sender) revert CannotDelegateToSelf();

This ensures boost delegation remains meaningful and prevents unnecessary edge cases.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.