Submission Details
Severity:
getBoostMultiplier() always returns MAX_BOOST instead of actual figure
Description
getBoostMultiplier() simply returns MAX_BOOST due to wrong calculation:
File: contracts/core/governance/boost/BoostController.sol
276: /**
277: * @notice Calculates the current boost multiplier for a user in a pool
278: * @param user Address of the user
279: * @param pool Address of the pool
280: * @return Current boost multiplier in basis points (1e4)
281: */
282: function getBoostMultiplier(
283: address user,
284: address pool
285: ) external view override returns (uint256) {
286: if (!supportedPools[pool]) revert PoolNotSupported();
287: UserBoost storage userBoost = userBoosts[user][pool];
288: if (userBoost.amount == 0) return MIN_BOOST;
289:
290: // Calculate actual boost multiplier in basis points
291:@---> uint256 baseAmount = userBoost.amount * 10000 / MAX_BOOST;
292:@---> return userBoost.amount * 10000 / baseAmount;
293: }
It returns:
userBoost.amount * 10000 / baseAmount
= (userBoost.amount * 10000) / (userBoost.amount * 10000 / MAX_BOOST)
= MAX_BOOST
Impact
If getBoostMultiplier() is used to calculate rewards, it will always evaluate to max boost based rewards given out to the user. Protocol loses funds.
Mitigation
Simply use the BoostCalculator.calculateTimeWeightedBoost() function which returns boostBasisPoints as one of its return values. Already called once on L116:
(uint256 boostBasisPoints, uint256 boostedAmount) = BoostCalculator.calculateTimeWeightedBoost(
params,
userBalance,
totalSupply,
amount
);
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
BoostController::getBoostMultiplier always returns MAX_BOOST for any non-zero boost due to mathematical calculation error, defeating the incentive mechanism
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.