Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Logical Error in getBoostMultiplier::BoostController.sol Always Returns MAX_BOOST if userBoost.amount != 0

oluwaseyisekoni

Summary

getBoostMultiplier intended to calculate a user’s boost multiplier for a specific pool in basis points (where 10,000 basis points = 100%), contains a logical error in its calculation. When userBoost.amount != 0, it computes

baseAmount = userBoost.amount * 10000 / MAX_BOOST

and

returns userBoost.amount * 10000 / baseAmount

Due to integer arithmetic, this simplifies to MAX_BOOST (typically 25,000 basis points or 2.5x), regardless of userBoost.amount or other factors. This undermines the function’s purpose of providing a variable boost multiplier, effectively making it constant when a boost exists.

Vulnerability Details

function getBoostMultiplier(
address user,
address pool
) external view override returns (uint256) {
if (!supportedPools[pool]) revert PoolNotSupported();
UserBoost storage userBoost = userBoosts[user][pool];
if (userBoost.amount == 0) return MIN_BOOST;
// Calculate actual boost multiplier in basis points
>> uint256 baseAmount = userBoost.amount * 10000 / MAX_BOOST;
>> return userBoost.amount * 10000 / baseAmount;
}

Impact

Incorrect evaluation of gettBoostMultiplier, misinformation

Tools Used

manual review

Recommendations

Scale boost based on userBoost.amount relative to a pool’s total boost or a fixed threshold

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::getBoostMultiplier always returns MAX_BOOST for any non-zero boost due to mathematical calculation error, defeating the incentive mechanism

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.