Core Contracts

Summary

getting the currect boost multiplier for a user in a pool by getBoostMultiplier() from BoostController.sol will always return the max boost

Vulnerability Details

When calculating the boost multiplier in the getBoostMultiplier() these are the calculations ->

The formula looks like this -> (x * 10 000) / 25 000 = baseAmount

return (x * 10 000) / baseAmount ;

which will always return 25 000, because

(x * 10 000) / (( x * 10 000) / 25 000)) = 25 000

the x * 10 000 will be cancelled out, thus will always return 25 000, regardless of the userBoost.amount

Impact

incorrect calculation, always returning the Max Boost

Tools Used

Recommendations

Use another logic for the calculation