Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing `poolBoost` Update in `BoostController.sol#delegateBoost()`

rampage

Summary

A missing update to poolBoost in the delegateBoost() function will cause inconsistent state tracking as the boost delegation amounts are not properly reflected in pool totals.

Root Cause

In BoostController.sol, the delegateBoost() function fails to update the poolBoosts mapping while other related functions like updateUserBoost() and removeBoostDelegation() properly maintain this state.

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external override nonReentrant {
if (paused()) revert EmergencyPaused();
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
emit BoostDelegated(msg.sender, to, amount, duration);
}

Impact

The protocol suffers from incorrect pool boost accounting as the poolBoosts totals do not reflect actual delegated amounts. This creates inconsistency between user delegation records and pool-level tracking.

Mitigation

Update the delegateBoost() function to properly maintain the poolBoosts mapping:

  • Add poolBoosts[to].totalBoost += amount;

  • Add poolBoosts[to].workingSupply += amount;

  • Add poolBoosts[to].lastUpdateTime = block.timestamp;

This will align the behavior with other boost-related functions and maintain accurate state tracking.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController removes pool boost on delegation removal without adding it on delegation creation, leading to accounting inconsistencies and potential underflows

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController removes pool boost on delegation removal without adding it on delegation creation, leading to accounting inconsistencies and potential underflows

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!