Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Stale Data Issue in `BoostController` Contract

xcrypt

Summary

The updateUserBoost function in the BoostController contract may return stale boost values due to the delegation lock issue. Since the delegation does not reset after expiry until the recipient manually removes it, users might operate with outdated data, leading to incorrect calculations and potential unfairness in boost distribution.

Vulnerability Details

Affected Function:

function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
if (paused()) revert EmergencyPaused();
if (user == address(0)) revert InvalidPool();
if (!supportedPools[pool]) revert PoolNotSupported();
UserBoost storage userBoost = userBoosts[user][pool];
PoolBoost storage poolBoost = poolBoosts[pool];
uint256 oldBoost = userBoost.amount;
// Calculate new boost based on current veToken balance
uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
userBoost.amount = newBoost;
userBoost.lastUpdateTime = block.timestamp;
// Update pool totals safely
if (newBoost >= oldBoost) {
poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
} else {
poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
}
poolBoost.workingSupply = newBoost; // Set working supply directly to new boost //@audit
poolBoost.lastUpdateTime = block.timestamp;
emit BoostUpdated(user, pool, newBoost);
emit PoolBoostUpdated(pool, poolBoost.totalBoost, poolBoost.workingSupply);
}
​

Root Cause:

  • The delegateBoost function prevents users from delegating again until the recipient removes the expired delegation.

  • Due to this, the updateUserBoost function may fetch stale data when calculating the new boost, as expired delegations remain in effect.

  • The newBoost calculation can be based on an outdated delegation state, leading to incorrect pool boost updates.

Impact

  • Users may have outdated or incorrect boost values, affecting rewards and fairness.

Tools Used

  • Manual code review

Recommendations

  1. Modify delegateBoost to automatically clear expired delegations before updating boosts:

    if (delegation.expiry <= block.timestamp) {
    delete userBoosts[msg.sender][to]; // Automatically clear expired delegation
    }
    ​

  2. Implement a mechanism in updateUserBoost to verify if the delegation has expired and remove stale data.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController: Users unable to remove their own expired boost delegations, creating dependency on recipients and preventing efficient reallocation of boosts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!