Core Contracts

Summary

The _applyBoost function calculates rewards using the user’s current VeToken balance . This approach fails to account for changes in boost during the reward period; it should instead use time‐weighted averages.

Vulnerability Details

The reward calculation is based on instantaneous values VeToken balance of user` rather than on values averaged over the period during which rewards accrue. This allows short-term fluctuations to unduly affect the reward outcome.

Impact

Users can manipulate their reward earnings by adjusting their VeToken balance or boost parameters immediately before claiming rewards. For example, a user might temporarily boost their weight to artificially inflate the calculated reward, receiving a disproportionate share of rewards.

Recommendations

Modify the reward calculation to use time‐weighted averages for fairness of reward distribution.