Core Contracts

Summary

The updateUserBoost function lacks access controls, allowing any address to modify boost values for any user in any pool. This oversight enables unauthorized manipulation of user boost parameters.

Vulnerability Details

The public updateUserBoost(address user, address pool) function has no caller restrictions. Any external entity can modify boost values, compromising the system's integrity by allowing unauthorized boost modifications.

Impact

Potential for malicious boost manipulation affecting reward calculations and distribution fairness.

Tools Used

• Manual code review

Recommendations

1. Add Access Control: Implement authorization checks:

   modifier onlyAuthorized() {

   require(msg.sender == owner || isAuthorized[msg.sender], "Not authorized");

   _;

   }

   Apply to updateUserBoost for controlled access.