Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Input Validation for `minBoost` in `BoostController::setBoostParameters` function

auditbyte

Summary

The BoostController::setBoostParameters function lacks proper validation for the minBoost parameter. While it checks that maxBoost is greater than minBoost and that maxBoost does not exceed a hard limit, it does not validate that minBoost is within a reasonable range. This could allow minBoost to be set to an invalid or unintended value, potentially disrupting the protocol's boost calculation logic

Vulnerability Details

In the BoostController::setBoostParameters function:

function setBoostParameters(
uint256 maxBoost,
uint256 minBoost,
uint256 boostWindow
) external onlyRole(MANAGER_ROLE) {
if (maxBoost < minBoost) revert InvalidBoostAmount();
if (maxBoost > 50000) revert MaxBoostExceeded(); // Max 5x absolute limit
if (boostWindow < 1 days || boostWindow > 30 days) revert InvalidDelegationDuration();
boostState.maxBoost = maxBoost;
boostState.minBoost = minBoost;
boostState.boostWindow = boostWindow;
emit BoostParametersUpdated(maxBoost, minBoost, boostWindow);
}

The vulnerability lies in the following part of the setBoostParameters function:

if (maxBoost < minBoost) revert InvalidBoostAmount();
if (maxBoost > 50000) revert MaxBoostExceeded(); // Max 5x absolute limit
if (boostWindow < 1 days || boostWindow > 30 days) revert InvalidDelegationDuration();

While the function ensures that maxBoost is greater than minBoost and that maxBoost does not exceed 50000, it does not validate the lower bound of minBoost.
For example:

  • If minBoost is set to 0, it could lead to unintended behaviour in boost calculations.

  • If minBoost is set to an excessively low value, it could disrupt the protocol's economic model or lead to unfair advantages for users.

Impact

  • An invalid minBoost value could disrupt the boost calculation logic

Tools Used

Manual code review

Recommendations

To mitigate this vulnerability, add input validation for minBoost to ensure it is within a reasonable range

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.