Summary
The BoostController::setBoostParameters() function does not validate the Boost value range as expected.
Vulnerability Details
The BoostController::setBoostParameters() function allows setting the Boost value within the range [1, 50000]. However, this is inconsistent with the documentation, which states that the maximum boost multiplier should be 2.5x.
* @notice Updates the boost calculation parameters
* @param maxBoost Maximum boost multiplier in basis points
* @param minBoost Minimum boost multiplier in basis points
* @param boostWindow Time window for boost calculations
* @dev Only callable by accounts with MANAGER_ROLE
*/
function setBoostParameters(
uint256 maxBoost,
uint256 minBoost,
uint256 boostWindow
) external onlyRole(MANAGER_ROLE) {
@> if (maxBoost < minBoost) revert InvalidBoostAmount();
@> if (maxBoost > 50000) revert MaxBoostExceeded();
if (boostWindow < 1 days || boostWindow > 30 days) revert InvalidDelegationDuration();
boostState.maxBoost = maxBoost;
boostState.minBoost = minBoost;
boostState.boostWindow = boostWindow;
emit BoostParametersUpdated(maxBoost, minBoost, boostWindow);
}
Poc
Add the following test to test/unit/core/governance/boost/BoostController.test.js and execute it:
describe("setBoostParameters()", () => {
it("[1,50000]", async () => {
const newMaxBoost = 2;
const newMinBoost = 1;
const newWindow = 14 * 24 * 3600;
await expect(
boostController.connect(manager).setBoostParameters(newMaxBoost, newMinBoost, newWindow)
).to.emit(boostController, "BoostParametersUpdated")
.withArgs(newMaxBoost, newMinBoost, newWindow);
});
});
Impact
Since this function requires the onlyRole(MANAGER_ROLE) permission, which is typically assigned to trusted accounts, the severity of this issue is classified as low. However, incorrect parameter settings by a trusted role could still lead to inconsistencies in boost calculations.
Tools Used
Manual Review
Recommendations
Modify the function to enforce the correct boost value range as per the documentation:
function setBoostParameters(
uint256 maxBoost,
uint256 minBoost,
uint256 boostWindow
) external onlyRole(MANAGER_ROLE) {
if (maxBoost < minBoost) revert InvalidBoostAmount();
+ if (minBoost < MIN_BOOST) revert InvalidBoostAmount();
- if (maxBoost > 50000) revert MaxBoostExceeded(); // Max 5x absolute limit
+ if (maxBoost > MAX_BOOST) revert MaxBoostExceeded(); // Max 2.5x absolute limit
if (boostWindow < 1 days || boostWindow > 30 days) revert InvalidDelegationDuration();
boostState.maxBoost = maxBoost;
boostState.minBoost = minBoost;
boostState.boostWindow = boostWindow;
emit BoostParametersUpdated(maxBoost, minBoost, boostWindow);
}
