Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Time-Weighted Reward Calculation Due to Overlapping Distribution Periods

edoscoba

Summary

The BoostController contract contains a critical vulnerability in its working supply calculation that overwrites the pool's total working supply with individual user boost values instead of accumulating them. This flaw leads to incorrect reward distributions by disregarding historical boost contributions.

Vulnerability Details

In the updateUserBoost function, the working supply is erroneously set to a single user's boost amount:

function updateUserBoost(address user, address pool) external override {
// ...
poolBoost.workingSupply = newBoost; // Flawed assignment
}

Technical Analysis

  • Error Type: State mutation error (overwrite vs accumulation)

  • Affected Component: Pool reward distribution mechanism

  • Trigger Condition: Any user boost update after initial pool activity

  • Attack Vector: Front-running boost updates before reward distributions

Impact

  1. Critical Severity:

    • Last updated user receives 100% of pool rewards

    • Other participants get 0 rewards regardless of actual contributions

  2. Protocol Impact:

    • Complete breakdown of reward distribution fairness

    • Enables trivial fund drainage attacks

    • Makes pool participation financially nonviable

Tools Used

  1. Manual Review

Recommendations

Immediate Fix

// Replace overwrite with delta-based update
if (newBoost >= oldBoost) {
uint256 delta = newBoost - oldBoost;
poolBoost.workingSupply += delta;
} else {
uint256 delta = oldBoost - newBoost;
poolBoost.workingSupply -= delta;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost overwrites workingSupply with single user's boost value instead of accumulating, breaking reward multipliers and allowing last updater to capture all benefits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.