Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

BoostController::updateUserBoost() overwrites the working supply instead of accumulating

mill1995

Summary

In the BoostController contract, the updateUserBoost() function directly overwrites the pool's workingSupply with a user's new boost amount instead of properly accumulating the total working supply across all users. This leads to incorrect tracking of the total working supply for pools.

Vulnerability Details

  1. The function correctly updates totalBoost by calculating the difference between new and old boost values

  2. However, it then incorrectly assigns workingSupply = newBoost, overwriting the entire pool's working supply with a single user's boost

  3. This effectively erases all other users' contributions to the working supply

function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
if (paused()) revert EmergencyPaused();
if (user == address(0)) revert InvalidPool();
if (!supportedPools[pool]) revert PoolNotSupported();
UserBoost storage userBoost = userBoosts[user][pool];
PoolBoost storage poolBoost = poolBoosts[pool];
uint256 oldBoost = userBoost.amount;
// Calculate new boost based on current veToken balance
uint256 newBoost = _calculateBoost(user, pool, 10000); // Base amount
userBoost.amount = newBoost;
userBoost.lastUpdateTime = block.timestamp;
// Update pool totals safely
if (newBoost >= oldBoost) {
poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
} else {
poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
}
@> poolBoost.workingSupply = newBoost; // Set working supply directly to new boost
poolBoost.lastUpdateTime = block.timestamp;
emit BoostUpdated(user, pool, newBoost);
emit PoolBoostUpdated(pool, poolBoost.totalBoost, poolBoost.workingSupply);
}

Impact

  • Tracking of working supply is wrong => while this has no direct impact on the contracts calculation itself, there might be some other parts of the system or off-chain mechanism that relies on this information.

Tools Used

  • Manual Review

Recommendations

The working supply should be updated by accounting for the difference between old and new boost values

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController::updateUserBoost overwrites workingSupply with single user's boost value instead of accumulating, breaking reward multipliers and allowing last updater to capture all benefits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.