Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

User can delegate full boost amount to multiple addresses

ke1caM

Summary

delegateBoost in BoostController contract allows user to delegate his boost to another address. The issue is that user can delegate 100% of his boost to infinite amount of addresses increasing the voting power of these addresses.

Vulnerability Details

If we look at delegateBoost we can see that it does not prevent user from delegating their boost to multiple addresses. It only checks if user does not try to delegate more than he has and if the to address is different than 0.

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
emit BoostDelegated(msg.sender, to, amount, duration);
}

Impact

The impact is very severe as this exploit allows user to create not existing votes and delegate them to different addresses increasing their voting power.

Tools Used

Manual Review, Hardhat

Recommendations

Fix delegateBoost function. Add checks to see if user delegated all of his boost. If yes revert and if not allow him to delegate rest of his boost.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks total delegation tracking, allowing users to delegate the same veTokens multiple times to different pools for amplified influence and rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.