Core Contracts

Summary

The contract inconsistently uses the InvalidPool() error for various parameter validations that are not related to a pool address. This misuse can lead to confusion during debugging and may mislead users and developers about the nature of the error encountered.

Vulnerability Details

In several functions throughout the contract, the InvalidPool() error is used even when the parameter being validated is not a pool address. For example:

• Constructor Check:

  if (_veToken == address(0)) revert InvalidPool();

  Here, the contract reverts with InvalidPool() when the provided veToken address is zero. Since this parameter represents a veToken and not a pool, the error message is misleading.

• Update User Boost Function:

  if (user == address(0)) revert InvalidPool();

  This check validates the user address but incorrectly reverts with InvalidPool(). The error should indicate that the user address is invalid, not a pool.

• Delegate Boost Function:

  if (to == address(0)) revert InvalidPool();

  In this case, the function checks the delegation recipient address and reverts with InvalidPool() if it is zero. Again, this is misleading since the recipient is not necessarily a pool.

These inconsistencies suggest that the same error message is being used for parameters of different contexts, potentially leading to misinterpretation of errors.

Impact

• Developer and User Confusion:
  Misleading error messages can make it difficult to diagnose the actual issue during contract interactions or audits, as a user might incorrectly assume that a pool address is invalid when, in fact, the problem lies with a veToken or user address.

• Increased Debugging Complexity:
  The inconsistent error messaging forces developers to spend extra time identifying the root cause of failures, which can slow down troubleshooting and development.

Tools Used

• Manual code review

Recommended Mitigation

Define Specific Error Messages:
Introduce dedicated error types for each parameter category. For example:

• error InvalidVeToken(); for veToken address validation.

• error InvalidUser(); for user address validation.

• error InvalidDelegationRecipient(); for delegation recipient validation.

Update Parameter Checks:
Replace instances of revert InvalidPool(); with the appropriate error:

• In the constructor, use if (_veToken == address(0)) revert InvalidVeToken();.

• In updateUserBoost, use if (user == address(0)) revert InvalidUser();.

• In delegateBoost, use if (to == address(0)) revert InvalidDelegationRecipient();.