Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Multiple Boost Delegations Exceeding User Balance Allowed

pelz

Summary

The delegateBoost function checks the user's veToken balance to validate the delegation amount but fails to consider previously active delegations. This oversight enables users to delegate the same veToken balance multiple times to different addresses, exceeding their actual voting power or boost capacity.

Vulnerability Details

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (to == msg.sender) revert CannotDelegateToSelf(); // Recommendation from [S-12]
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
​
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
​
UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
​
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
​
emit BoostDelegated(msg.sender, to, amount, duration);
}

Issue

  • Current check: userBalance < amount ensures a single delegation does not exceed the user's veToken balance.

  • Missing check: No consideration of existing active delegations from the same user.

  • Result: A user with 100 veTokens can delegate 100 tokens to multiple addresses, surpassing their actual balance.

Impact

  • Users can amplify their influence or rewards beyond intended limits.

  • Boost distribution integrity is compromised.

  • Potential economic exploitation if boosts affect voting power, liquidity incentives, or rewards.

Tools Used

Manual code review.

Recommendations

Track total delegated amounts and ensure they do not exceed the user's balance:

uint256 totalDelegated = getTotalDelegated(msg.sender);
if (userBalance < totalDelegated + amount) revert ExceedsAvailableDelegation();

Implement getTotalDelegated to sum all active delegations:

function getTotalDelegated(address user) public view returns (uint256 total) {
for (address delegate : delegates[user]) {
UserBoost memory delegation = userBoosts[user][delegate];
if (block.timestamp < delegation.expiry) {
total += delegation.amount;
}
}
}

This ensures users cannot delegate more than their available veToken balance.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks total delegation tracking, allowing users to delegate the same veTokens multiple times to different pools for amplified influence and rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.