Core Contracts

Summary

The contract allows users to delegate their boost to another address, but it does not reduce the delegator’s available boost balance after delegation. This means a user can delegate the same boost multiple times without any restriction, effectively inflating the total boost available in the system. This leads to an unintended exploitation where multiple delegatees can use the same boost, breaking the intended boost allocation logic.

Vulnerability Details

The issue arises from how the contract handles delegation without updating the delegator’s available boost balance. When a user delegates a boost, the following code executes:

However, there is no corresponding deduction from the delegator’s original boost balance the logic only check to make sure the amount <= userBalance:

Since the delegator’s balance remains unchanged, they can repeatedly delegate their boost to multiple addresses, effectively multiplying the total boost in the system.

For instance:

1. Assume Alice has 100 boost in somePool.

2. Alice delegates 100 boost to Bob (userBoosts[Alice][Bob] = 100).

3. Alice then delegates 100 boost to Charlie (userBoosts[Alice][Charlie] = 100).

4. Now, Bob and Charlie each have 100 boost, but Alice still retains her original 100 boost.

This means the total boost available in the system is 300 instead of the intended 100.

A proper delegation mechanism should follow the principle:

Without this reduction, users can abuse the system by over-delegating and inflating total boosts.

Impact

• Users can delegate the same boost multiple times without limitation.

• Boost inflation leads to unfair advantages, as multiple users can benefit from the same boost.

• The total boost in the system becomes unbounded, potentially breaking balance calculations.

• This can be exploited to gain excessive rewards or benefits tied to boosts.

Tools Used

• Manual code review

Recommendations

• Implement a mechanism to reduce the delegator’s available boost balance upon delegation:

  userBoosts[msg.sender][somePool].amount -= amount; // Reduce delegator's boost