Core Contracts

Summary

The delegateBoost function in the smart contract allows users to delegate their boost to another address. However, the contract contains two vulnerabilities:

1. Users can delegate boost to themselves, effectively "doubling" their boost without increasing their actual token holdings.

2. The contract does not reduce the msg.sender’s boost after delegation, allowing users to retain their original boost and gain an additional boost through delegation. This leads to an unfair increase in boost.

Vulnerability Details

1 - Self-Delegation Vulnerability:
The delegateBoost function allows users to delegate boost power to another address, but it does not prevent users from delegating boost to themselves. The relevant code section is:
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/governance/boost/BoostController.sol#L212-L234

There is no validation to prevent the msg.sender from being the same as the to address. As a result, users can delegate boost to themselves, effectively increasing their boost power without increasing their actual token holdings.

2 - Missing Boost Reduction:
The contract does not correctly reduce the msg.sender's boost after the delegation occurs. The relevant logic is missing, and as a result, users can delegate boost to others without it being subtracted from their own balance. This leads to users having more boost than they should. This can result in users gaining excessive boost without giving up any of their own, leading to a double-boost effect.

Impact

Double Boost: Users can effectively double their boost by delegating to themselves.

Excessive Boost: Due to the missing boost reduction, users can retain their original boost in addition to any delegated boost, further inflating their boost.

Tools Used

Manual code review

Recommended Mitigation

Add a check to prevent the msg.sender from delegating boost to themselves by checking if to == msg.sender and reverting if true:

1 - Prevent Self-Delegation:

2 - Ensure Boost Reduction After Delegation:
When boost is delegated, ensure that the corresponding amount is subtracted from the sender’s own boost. Modify the logic to reduce the sender’s boost when delegation occurs.