Core Contracts

Summary

The updateUserBoost function in BoostController.sol incorrectly updates poolBoost.workingSupply by directly assigning it to the newly calculated newBoost value. This behavior is inconsistent with the intended functionality of workingSupply, which should represent the sum of all active working supplies in the pool icluding boosts. Instead of being overwritten, it should be incremented by newBoost and decremented by oldBoost, similar to how poolBoost.totalBoost is updated.

Vulnerability Details

Within the updateUserBoost function, after computing newBoost, the following operation is performed:

This directly assigns workingSupply to newBoost, effectively disregarding any previous contributions from other users. However, based on the PoolBoost struct’s natspec documentation, workingSupply should be a cumulative sum, reflecting the total active boost within the pool.

Impact

Due to this incorrect update logic, workingSupply does not accurately reflect the total boost across users in the pool. This can lead to:

1. Incorrect Boost Calculations – Future calculations relying on workingSupply may produce incorrect results.

2. Unfair Rewards Distribution – If rewards are allocated based on workingSupply, users may receive improper allocations.

3. Potential Exploitation – A user could reset the pool’s workingSupply by calling updateUserBoost, leading to unpredictable pool behavior.

Tools Used

Manual code review

Recommended Mitigation

Modify the update logic for poolBoost.workingSupply to correctly track net changes in boost contributions:

This will ensure that workingSupply correctly represents the sum of active working supplies in the pool, aligning with its intended function.