Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Boost delegation removals will never be accounted for as removeBoostDelegations() function does not retrieve the correct pool to update for

0xgremlincat

Summary

In BoostController.sol, users can delegate boosts to another address. In the event of expired boost delegation, the recipient of the delegation can call removeBoostDelegation(). However in this function when retrieving the poolBoost struct for the respective pool, it passes the address of the delegation recipient instead of the address of the pool. This will result in boost delegation removals to never be accounted for.

Vulnerability Details

/**
* @notice Removes an expired boost delegation
* @param from Address that delegated the boost
* @dev Can only be called by the delegation recipient after expiry
*/
function removeBoostDelegation(address from) external override nonReentrant {
UserBoost storage delegation = userBoosts[from][msg.sender];
if (delegation.delegatedTo != msg.sender) revert DelegationNotFound();
if (delegation.expiry > block.timestamp) revert InvalidDelegationDuration();
// Update pool boost totals before removing delegation
PoolBoost storage poolBoost = poolBoosts[msg.sender];
if (poolBoost.totalBoost >= delegation.amount) {
poolBoost.totalBoost -= delegation.amount;
}
if (poolBoost.workingSupply >= delegation.amount) {
poolBoost.workingSupply -= delegation.amount;
}
poolBoost.lastUpdateTime = block.timestamp;
emit DelegationRemoved(from, msg.sender, delegation.amount);
delete userBoosts[from][msg.sender];
}

In the above function, line 7 shows that the msg.sender, which is the delegation recipient, is passed in poolBoosts mapping. Since there is no existing pool at the msg.sender's address, the parameters of the poolBoost struct such as totalBoost and workingSupply will always return 0. The removal of the expired boost delegation will hence never be accounted for at the pool level.


Impact

Accounting of the pool's boost metrics will be inaccurate, and all expired boost delegations will never be accounted for as well.

Tools Used

Manual

Recommendations

Ensure the pool address parameter is passed when retrieving from poolBoosts[] mapping in BoostController.sol.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController's delegation system fundamentally broken due to missing pool associations, treating recipient addresses as pools and never properly updating pool boost metrics

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!