Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Validation Against Global Boost Limits in BoostController

0xterrah

Relevant GitHub Links

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/boost/BoostController.sol#L39-L42

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/boost/BoostController.sol#L375

Summary

The setBoostParameters function in BoostController.sol lacks validation against the protocol's global boost limits (MIN_BOOST and MAX_BOOST), allowing boost parameters to be set outside intended ranges.

Vulnerability Details

The setBoostParameters function only validates:

function setBoostParameters(
uint256 maxBoost,
uint256 minBoost,
uint256 boostWindow
) external onlyRole(MANAGER_ROLE) {
if (maxBoost < minBoost) revert InvalidBoostAmount();
if (maxBoost > 50000) revert MaxBoostExceeded(); // Max 5x absolute limit
if (boostWindow < 1 days || boostWindow > 30 days) revert InvalidDelegationDuration();
boostState.maxBoost = maxBoost;
boostState.minBoost = minBoost;
boostState.boostWindow = boostWindow;
}

However, the protocol defines global limits:

uint256 public constant MAX_BOOST = 25000; // 2.5x
uint256 public constant MIN_BOOST = 10000; // 1x

The function fails to validate that:

  • minBoost >= MIN_BOOST (10000)

  • maxBoost <= MAX_BOOST (25000)

Impact

  • Boost parameters can be set outside protocol's intended limits (1x-2.5x)

  • Can disrupt reward distribution mechanisms and voting power calculations

  • Could cause protocol functionality issues through incorrect boost multipliers

  • Impact is mitigated by MANAGER_ROLE requirement and 5x absolute limit

Tools Used

Manual Review

Recommendations

Add validation against global boost limits:

function setBoostParameters(
uint256 maxBoost,
uint256 minBoost,
uint256 boostWindow
) external onlyRole(MANAGER_ROLE) {
if (minBoost < MIN_BOOST) revert InvalidBoostAmount();
if (maxBoost > MAX_BOOST) revert MaxBoostExceeded();
if (maxBoost < minBoost) revert InvalidBoostAmount();
if (boostWindow < 1 days || boostWindow > 30 days) revert InvalidDelegationDuration();
boostState.maxBoost = maxBoost;
boostState.minBoost = minBoost;
boostState.boostWindow = boostWindow;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!