Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Everybody can maliciously update the other users' boost amount in `BoostController`

kirobrejka

Summary

This is due to the hardcoded value in the BoostController::updateUserBoost function

Vulnerability Details

The problem of the fuction can be seen in the highlighted line of code:

function updateUserBoost(
address user,
address pool
) external override nonReentrant whenNotPaused {
if (paused()) revert EmergencyPaused();
if (user == address(0)) revert InvalidPool();
if (!supportedPools[pool]) revert PoolNotSupported();
​
UserBoost storage userBoost = userBoosts[user][pool];
PoolBoost storage poolBoost = poolBoosts[pool];
​
uint256 oldBoost = userBoost.amount;
// Calculate new boost based on current veToken balance
@> uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
​

This practically means that when the function is called, it will negatively impact the boost allocation of the user and he won't be able to fix it

Impact

The boost allocation of the user will practically be forever messed until pool address call the removeBoostDelegation function. This can be performed for every existing allocation possible, making the BoostController practically useless

Tools Used

Manual review

Recommendations

Restrict the function so that only the user is the msg.sender and allow him to specify the exact amount he wants to change his delegation with, by capping it with his veRAAC token balance

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost lacks caller validation, allowing anyone to force delegation of any user's boost to any pool without consent, hijacking voting power

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost lacks caller validation, allowing anyone to force delegation of any user's boost to any pool without consent, hijacking voting power

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!