Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Delegated Boost System in BoostController is Non-Functional Due to Missing Integration

0xterrah

Relevant GitHub Links

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/boost/BoostController.sol#L229-L232

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/boost/BoostController.sol#L88-L130

Summary

The BoostController.sol contract provides functionality for users to delegate their boost (delegateBoost function), but the delegated boost amounts are never used in core boost calculation functions. This makes the entire boost delegation system non-functional.

Vulnerability Details

The delegateBoost function stores delegation data:

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external nonReentrant {
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
}

However, the core boost calculation in _calculateBoost only uses direct veToken balances:

function _calculateBoost(
address user,
address pool,
uint256 amount
) internal view returns (uint256) {
uint256 userBalance = IERC20(address(veToken)).balanceOf(user);
uint256 totalSupply = IERC20(address(veToken)).totalSupply();
// Only uses direct balance, ignores delegations
(uint256 boostBasisPoints, uint256 boostedAmount) = BoostCalculator.calculateTimeWeightedBoost(
params,
userBalance,
totalSupply,
amount
);
}

Impact

  • Users waste gas delegating boost that has no effect

  • Protocol advertises non-functional feature

  • Delegatees receive no boost benefits

  • Reward distribution doesn't account for delegations as intended

Tools Used

Manual Review

Recommendations

Modify _calculateBoost to include delegated amounts when calculating user's boost.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::_calculateBoost ignores delegated veToken amounts when calculating boost, rendering the entire delegation mechanism non-functional and breaking reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!