Submission Details
Severity:
BoostController.updateTotalWeight() will return 0 values for totalWeight and votingPower
Summary
BoostController.updateTotalWeight() will return 0 values for totalWeight and votingPower
Vulnerability Details
BoostController.updateTotalWeight() will always return `totalWeight` and `votingPower` = 0 as BoostController contract lacks a mechanism to call lock() or increase() in veToken contract.
Impact
The returned value for `totalWeight` and `votingPower` by updateTotalWeight() will always be 0.
Tools Used
Manual review
Recommendations
Add a mechanism in BoostController contract which allows this contract to call lock() and increase() functions in veRAACToken contract.
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
BoostController::updateTotalWeight queries its own nonexistent lock position and voting power when calculating boosts, resulting in zero values that break all boost calculations
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.