Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

BoostController's Working Supply Overwrite Leads to Incorrect Delegation Accounting

0xekkoo

Summary

The updateUserBoost function incorrectly overwrites the pool's working supply instead of accumulating it, causing the removeBoostDelegation function leading to incorrect boost accounting across the protocol.

Vulnerability Details

In the BoostController contract updateUserBoost() function, there's a critical mismatch between how working supply is updated and how it's used:

function updateUserBoost(address user, address pool) external {
// ...
uint256 newBoost = calculateBoost(user, pool, 10000);
​
// @audit - Critical: Overwrites instead of accumulating
poolBoost.workingSupply = newBoost; // Direct overwrite
}

In the removeBoostDelegation, it assumes that the working supply is a cummulative amount

function removeBoostDelegation(
address from
) external override nonReentrant {
UserBoost storage delegation = userBoosts[from][msg.sender];
// ...
// @audit - Assumes workingSupply is cummulative
if (poolBoost.workingSupply >= delegation.amount) {
poolBoost.workingSupply -= delegation.amount;
}
​
}

Scenario:

  1. User A gets boost of 1000

    • workingSupply = 1000

  2. User B gets boost of 500

    • workingSupply = 500 (overwrites A's boost instead of 1500)

  3. User A tries to remove delegation of 1000

    • Attempts: 500 - 1000

    • Results in underflow or incorrect accounting

Impact

Incorrect boost accounting & Incorrect reward calculations if based on working supply

Recommendation

accumulate properly the poolBoost.workingSupply.

if (newBoost >= oldBoost) {
poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
+ poolBoost.workingSupply = poolBoost.workingSupply + (newBoost - oldBoost);
} else {
poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
+ poolBoost.workingSupply = poolBoost.workingSupply - (oldBoost - newBoost);
}
- poolBoost.workingSupply = newBoost;
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost overwrites workingSupply with single user's boost value instead of accumulating, breaking reward multipliers and allowing last updater to capture all benefits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!