Submission Details
Severity:
getBoostMultiplier() in BoostController always returns MAX_BOOST if user boost amount is not 0
Summary
getBoostMultiplier() in BoostController always returns MAX_BOOST if user boost amount is not 0.
Vulnerability Details
getBoostMultiplier() calculates the current boost multiplier for a user as below:
BoostController::getBoostMultiplier()
// Calculate actual boost multiplier in basis points
uint256 baseAmount = userBoost.amount * 10000 / MAX_BOOST;
return userBoost.amount * 10000 / baseAmount;
To simplify:
boost multiplier = userBoost.amount * 10000 / (userBoost.amount * 10000 / MAX_BOOST)
boost multiplier = MAX_BOOST
Impact
Boost multiplier is incorrectly calculated.
Tools Used
Manual Review
Recommendations
Use BoostCalculator.calculateTimeWeightedBoost() to calculate boost multiplier.
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
BoostController::getBoostMultiplier always returns MAX_BOOST for any non-zero boost due to mathematical calculation error, defeating the incentive mechanism
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.