Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

After delegation user still holds his original boost

ke1caM

Summary

delegateBoost in BoostController contract allows user to delegate his boost to another address. The issue is that after delegation, user still holds 100% of his boost.

Vulnerability Details

If we look at delegateBoost we can see that after the boost is delegated the user still holds his voting power and can use veRAACTokens to create and vote for proposals. Boost delegation means that user gives his votes to other address so that it can vote in his name. In this situation the user gives away his votes through delegation and still keeps his veRAACTokens as voting power. He can still use them after delegation.

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
emit BoostDelegated(msg.sender, to, amount, duration);
}

Impact

After delegation user still has his voting power. This means that voting power increases without the veRAACTokens creation. This is a serious problem as veRAACTokens are used to create and vote for proposals in the Governance system.

Tools Used

Manual Review, Hardhat

Recommendations

After the boost is delegated, prevent user from using his delegated veRAACTokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks total delegation tracking, allowing users to delegate the same veTokens multiple times to different pools for amplified influence and rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.