Core Contracts

Summary

The updateUserBoost function erroneously sets the pool's aggregate working supply to an individual user's boost value instead of updating it in an aggregated fashion. This vulnerability enables a user to manipulate the pool's total boost metrics by overwriting the working supply.

Vulnerability Details

In the updateUserBoost function, after recalculating a user's boost, adjusts the pool’s total boost correctly by adding or subtracting the difference between the new and old boost values, but the function then directly assigns poolBoost.workingSupply the value of newBoost, which belongs solely to the individual user. This action breaks the security guarantee that pool-level metrics represent the aggregate boost of all users. A malicious user repeatedly calling updateUserBoost can arbitrarily set the pool's workingSupply, resulting in manipulated boost metrics across the pool.

Impact

Rating this as High because this compromises the integrity of the pool's boost metrics, which are used for calculating rewards, governance influence, and other critical protocol parameters.

The attack occurs deterministically every time a user calls updateUserBoost and is easily executable by any participant with access to update their boost. The flaw has a severe impact on pool-level calculations and overall system fairness, as it allows a single user to control an aggregate metric that must be collectively maintained.

Tools Used

Manual Review

Recommendations

Change the overwriting (poolBoost.workingSupply = newBoost) into an incremental update that adds or subtracts the difference in the user’s new boost vs. their old boost.