Core Contracts

Summary

The delegateBoost function in the BoostController contract contains a flaw where users are unable to re-delegate their boost after the delegation period expires. If the recipient does not manually remove the expired delegation, the original delegator is permanently blocked from delegating again. This results in a usability issue, where users may find themselves unable to delegate boosts unless the recipient takes action.

Vulnerability Details

Affected Function

Root Cause

The issue arises from the following line in the code:

This condition prevents any new delegation if there is already a delegation, even if the prior delegation has expired. For the original delegator to regain the ability to delegate, the recipient must manually call removeBoostDelegation after the delegation expires. If the recipient does not take this action, the original delegator is locked out from delegating again.

Problems Caused

1. Permanent Delegation Lock: If the recipient does not manually remove the expired delegation, the original delegator will be permanently unable to delegate their boost.

2. User Dependence: The original delegator's ability to re-delegate is entirely dependent on the recipient, which introduces a usability issue and creates an unnecessary dependency on the recipient’s action.

Impact

• Inability to Re-delegate: Users may be unable to delegate their boost again if the recipient does not actively manage expired delegations, reducing the flexibility of the system.

• Fairness Issues: The system places an unfair burden on the recipient to manage expired delegations, limiting the usability of the delegation feature for the original delegator.

Tools Used

• Manual Code Review

Recommendations

Suggested Fixes

1. Allow Re-delegation After Expiry: Modify the delegateBoost function to permit re-delegation after the delegation period has expired, but still prevent multiple active delegations.

   if (delegation.expiry > block.timestamp && delegation.amount > 0) {

   revert BoostAlreadyDelegated(); // Prevents re-delegation while active, allows after expiry

   }

2. Automatically Clear Expired Delegations: To ensure that expired delegations do not block future delegations, clear expired delegations automatically before assigning a new one.

   if (delegation.expiry <= block.timestamp) {

   delete userBoosts[msg.sender][to]; // Automatically clear expired delegations

   }