Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Boost delegation vulnerable to front-running leading to boost manipulation

0xtheblackpanther

Description

The BoostController's delegation mechanism is vulnerable to front-running attacks. The delegateBoost() function delegates boost power but doesn't track boost usage, and updateUserBoost() doesn't verify remaining boost availability:

function delegateBoost(address to, uint256 amount, uint256 duration) external {
delegation.amount = amount;
delegation.delegatedTo = to;
}
​
function updateUserBoost(address user, address pool) external {
uint256 newBoost = _calculateBoost(user, pool, 10000);
userBoost.amount = newBoost;
}

Let's dig into the attack path:

  1. Delegator with high veRAC balance delegates boost to user

  2. When user attempts to use the boost, delegator front-runs transaction

  3. Delegator consumes boost power first

  4. User's transaction completes but receives minimal boost

  5. User loses potential rewards due to reduced boost

Recommendation

Track used boost amounts:

mapping(address => uint256) public usedBoost;
​
function updateUserBoost(address user, address pool) external {
uint256 availableBoost = delegation.amount - usedBoost[user];
require(availableBoost >= minBoostRequired, "Insufficient boost");
usedBoost[user] += newBoost;
userBoost.amount = newBoost;
}

Add minimum boost parameter to protect users:

function updateUserBoost(
address user,
address pool,
uint256 minBoostRequired
) external {
uint256 newBoost = _calculateBoost(user, pool, 10000);
require(newBoost >= minBoostRequired, "Boost too low");
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.