Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Incorrect Revert Message for Invalid Address in `BoostController::updateUserBoost` function

auditbyte

Summary

The BoostController::updateUserBoost function checks if the user address is the zero address but incorrectly reverts with the InvalidPool() error message which is not the correct message. It creates confusion and misleads users or developers about the nature of the error.

Vulnerability Details

The vulnerability lies in the following line of code:

if (user == address(0)) revert InvalidPool();

Here, the function checks if the user address is the zero address, which is a valid check to prevent invalid inputs. However, the error message InvalidPool() is misleading because the issue is related to the user address, not the pool address. The correct error message should be InvalidUser() to accurately reflect the nature of the error.

Example Scenario:

  1. A user accidentally passes address(0) as the user parameter.

  2. The function reverts with the error InvalidPool(), which is confusing because the issue is with the user address, not the pool address.

  3. Developers or users may misinterpret the error, leading to unnecessary debugging efforts.

Impact

Developers or users may mistakenly assume the pool parameter is invalid rather than user.

Tools Used

Manual Code Review

Recommendations

To address this issue, update the error message to accurately reflect the nature of the error. Ensure InvalidUser() event is declared and replace InvalidPool() with InvalidUser() in the following line:

function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
if (paused()) revert EmergencyPaused();
- if (user == address(0)) revert InvalidPool();
+. if (user == address(0)) revert InvalidUser();
if (!supportedPools[pool]) revert PoolNotSupported();
UserBoost storage userBoost = userBoosts[user][pool];
PoolBoost storage poolBoost = poolBoosts[pool];
uint256 oldBoost = userBoost.amount;
// Calculate new boost based on current veToken balance
uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
userBoost.amount = newBoost;
userBoost.lastUpdateTime = block.timestamp;
// Update pool totals safely
if (newBoost >= oldBoost) {
poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
} else {
poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
}
poolBoost.workingSupply = newBoost; // Set working supply directly to new boost
poolBoost.lastUpdateTime = block.timestamp;
emit BoostUpdated(user, pool, newBoost);
emit PoolBoostUpdated(pool, poolBoost.totalBoost, poolBoost.workingSupply);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.