Core Contracts

Summary

The delegateBoost function in the BoostController contract does not allow users to delegate their boost more than once. Even after the delegation period expires, the original delegator cannot re-delegate unless the recipient manually removes the expired delegation. This creates a scenario where a user may be permanently blocked from delegating if the recipient does not actively clear the expired delegation.

Vulnerability Details

Affected Function

Root Cause

• The condition if (delegation.amount > 0) revert BoostAlreadyDelegated(); permanently prevents a user from delegating again if the recipient does not manually remove the expired delegation.

• The removeBoostDelegation function must be called by the recipient after the expiry for the original delegator to regain delegation ability.

• If the recipient does not call removeBoostDelegation, the original delegator remains locked out of future delegations.

Impact

• Users may be permanently unable to delegate their boost if the recipient is inactive or unwilling to remove the expired delegation.

• This creates an unnecessary dependency on the recipient to take action, limiting usability and fairness.

Tools Used

• Manual Code Review

Recommendations

Suggested Fix:

1. Modify the delegateBoost function to allow re-delegation after expiry:

   if (delegation.expiry > block.timestamp && delegation.amount > 0) {

   revert BoostAlreadyDelegated(); // Prevent active redelegation but allow expired ones

   }

   ​

2. Automatically clear expired delegations in delegateBoost before assigning a new one:

   if (delegation.expiry <= block.timestamp) {

   delete userBoosts[msg.sender][to]; // Clear expired delegation

   }

   ​