Core Contracts

Summary

The BoostController contract uses minimum an maximum boost variables for several calculations. The problem is that To handle it's state it uses an BoostCalculator.BoostState instance in which it stores maxBoost and minBoost values which can later be updated, but for some calculations it uses the initial constants of MAX_BOOST and MIN_BOOST instead of the BoostState variables.

Vulnerability Details

The instances where the constants are being used are: BoostController.sol#L126, BoostController.sol#L288 and BoostController.sol#L291

Impact

Incorrect information being returned or used in calculations.

Tools Used

Manual review.

Recommendations

Use the BoostState variables in the instances mentioned above.