Core Contracts

Summary

The function getBoostMultiplier incorrectly calculates the boost multiplier due to a flawed formula. Instead of properly determining the multiplier based on the user’s veToken balance, it incorrectly derives a value that does not correctly reflect the intended boost mechanics.

Vulnerability Details

In getBoostMultiplier, the boost multiplier is computed as:

• The baseAmount calculation incorrectly scales userBoost.amount, but the final division essentially cancels out the intended effect, returning an incorrect boost value.

• If userBoost.amount == MAX_BOOST, then baseAmount = 10000, making the function return userBoost.amount, which is not a valid multiplier in basis points.

By contrast, the correct boost calculation is seen in calculateBoost:

This correctly computes the boost based on the user's veToken balance relative to the total supply.

Impact

• The incorrect calculation could lead to misrepresented boost values, potentially allowing incorrect reward distributions or unintended behavior in the system.

Tools Used

Manual Review

Recommendations

• Update getBoostMultiplier to use a calculation similar to calculateBoost, ensuring that the boost is based on the user’s veToken balance relative to total veToken supply.