Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Boost Delegation Can Be Reused Leading to Multiplied Voting Power

0xterrah

Relevant GitHub Links

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/boost/BoostController.sol#L212-L234

Summary

The delegateBoost function in BoostController.sol allows users to delegate their boost to multiple addresses without reducing their delegatable power, enabling infinite reuse of the same boost amount.

Vulnerability Details

The delegateBoost function records delegations without tracking or reducing the delegator's available boost power. This allows a user to delegate the same boost amount multiple times, effectively multiplying their influence in the protocol.

function delegateBoost(
address to,
uint256 amount,
uint256 duration
) external nonReentrant {
if (to == address(0)) revert InvalidPool();
if (amount == 0) revert InvalidBoostAmount();
if (duration < MIN_DELEGATION_DURATION || duration > MAX_DELEGATION_DURATION)
revert InvalidDelegationDuration();
uint256 userBalance = IERC20(address(veToken)).balanceOf(msg.sender);
if (userBalance < amount) revert InsufficientVeBalance();
UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;
emit BoostDelegated(msg.sender, to, amount, duration);
}

Proof of Concept (Simplified):

// User with 1000 boost power
delegateBoost(alice, 1000, 7 days); // Delegates 1000 to Alice
delegateBoost(bob, 1000, 7 days); // Delegates same 1000 to Bob
delegateBoost(carol, 1000, 7 days); // Delegates same 1000 to Carol
// Result: 3000 total delegated boost while only having 1000

Impact

  • Users can infinitely multiply their boost power through multiple delegations

  • Severely distorts voting power and reward distribution mechanisms

  • Compromises protocol governance and economic incentives

  • Early exploiters could gain disproportionate control over protocol decisions

Tools Used

Manual Review

Recommendations

Track and enforce delegation limits.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::delegateBoost lacks total delegation tracking, allowing users to delegate the same veTokens multiple times to different pools for amplified influence and rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.