Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Discrepancy in pool updates in `BoostController`

dentonylifer

Summary

Discrepancy in pool updates in BoostController can lead to underflow DoS and incorrect state variables values.

Vulnerability Details

Link

Users can delegate their boost to another address using delegateBoost(). Delegation updated userBoosts[msg.sender][to] state variable.

UserBoost storage delegation = userBoosts[msg.sender][to];
if (delegation.amount > 0) revert BoostAlreadyDelegated();
delegation.amount = amount;
delegation.expiry = block.timestamp + duration;
delegation.delegatedTo = to;
delegation.lastUpdateTime = block.timestamp;

Then user (to address) can remove expired boost delegation using removeBoostDelegation():

// Update pool boost totals before removing delegation
PoolBoost storage poolBoost = poolBoosts[msg.sender];
if (poolBoost.totalBoost >= delegation.amount) {
poolBoost.totalBoost -= delegation.amount;
}
if (poolBoost.workingSupply >= delegation.amount) {
poolBoost.workingSupply -= delegation.amount;
}
poolBoost.lastUpdateTime = block.timestamp;
emit DelegationRemoved(from, msg.sender, delegation.amount);
delete userBoosts[from][msg.sender];

The problem is the function not only removes delegation, but also decreases pool boost totals. For comparison, pool boost totals wasn't increased during delegation creation.

Malicious user can create multiple delegations with min duration, and then remove all of them and decrease pool boost totals extremely low values. Thus any other legitimate actions, like boost updates and removals will revert due to uderflow revert in poolBoost.totalBoost:

function updateUserBoost(address user, address pool) external override nonReentrant whenNotPaused {
//...
if (newBoost >= oldBoost) {
poolBoost.totalBoost = poolBoost.totalBoost + (newBoost - oldBoost);
} else {
poolBoost.totalBoost = poolBoost.totalBoost - (oldBoost - newBoost);
}

Impact

Discrepancy in pool updates in BoostController

Tools Used

Manual review.

Recommendations

Update pool boost totals consistently.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController removes pool boost on delegation removal without adding it on delegation creation, leading to accounting inconsistencies and potential underflows

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BoostController removes pool boost on delegation removal without adding it on delegation creation, leading to accounting inconsistencies and potential underflows

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!