Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

BoostController.updateUserBoost() can be called on behalf of other user

elser17

Summary

BoostController.updateUserBoost() can be called on behalf of other user

Vulnerability Details

There is no access control in updateUserBoost() function, which allows to update the boost value of a user for a pool, both passed as parameters. This allows anybody to update/delete the boosted value for desired user and pool in a not suitable moment, which can be used by malicious users to break the expected operation mode of the contract.

Impact

Malicious user can update the boost value of input user and pool or set the boost value of a user who has a high voting power for a pool that owner of that voting power does not wish.

Tools Used

Manual review

Recommendations

Add access control to updateUserBoost() function (so that only a trusted address can set boost values) or do not allow `user` as a parameter and use `msg.sender`:

- function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
+ function updateUserBoost(address pool) external override nonReentrant whenNotPaused {
if (paused()) revert EmergencyPaused();
- if (user == address(0)) revert InvalidPool();
if (!supportedPools[pool]) revert PoolNotSupported();
- UserBoost storage userBoost = userBoosts[user][pool];
+ UserBoost storage userBoost = userBoosts[msg.sender][pool];
PoolBoost storage poolBoost = poolBoosts[pool];
uint256 oldBoost = userBoost.amount;
// Calculate new boost based on current veToken balance
- uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
+ uint256 newBoost = _calculateBoost(msg.sender, pool, 10000); // Base amount
userBoost.amount = newBoost;
userBoost.lastUpdateTime = block.timestamp;
// Update pool totals safely
if (newBoost >= oldBoost) {
poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
} else {
poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
}
poolBoost.workingSupply = newBoost; // Set working supply directly to new boost
poolBoost.lastUpdateTime = block.timestamp;
- emit BoostUpdated(user, pool, newBoost);
+ emit BoostUpdated(msg.sender, pool, newBoost);
emit PoolBoostUpdated(pool, poolBoost.totalBoost, poolBoost.workingSupply);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost lacks caller validation, allowing anyone to force delegation of any user's boost to any pool without consent, hijacking voting power

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost lacks caller validation, allowing anyone to force delegation of any user's boost to any pool without consent, hijacking voting power

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.