Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Boost Multiplier Calculation Oversight

dharkartz

Summary

The getBoostMultiplier function contains a critical mathematical error where any non-zero userBoost.amount results in MAX_BOOST. The division operation incorrectly normalizes values, leading to constant maximum returns.

Vulnerability Details

Problematic Implementation:

uint256 baseAmount = userBoost.amount * 10000 / MAX_BOOST;
return userBoost.amount * 10000 / baseAmount;

Issue: The calculation effectively divides a value by itself after scaling, resulting in a constant maximum multiplier for any non-zero input.

Impact

  • Maximum boost applied regardless of actual qualification

  • Inequitable reward distribution

  • Misleading boost indicators affecting user decisions

Tools Used

  • Manual code review

  • Solidity static analysis

Recommendations

  • Implement proper boost calculation formula considering actual user metrics

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::getBoostMultiplier always returns MAX_BOOST for any non-zero boost due to mathematical calculation error, defeating the incentive mechanism

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.