157.md

Chilly Rose Hornet

Medium

Assumption about _makeIncentives in createBoost function

Summary

BoostCore::createBoost function assumes that _makeIncentives always succeeds without reverting.

Vulnerability Detail

BoostCore::createBoost function assumes that _makeIncentives always succeeds without reverting, potentially leading to inconsistent state, incomplete initialization and gas waste. Errors are also not propagated to the caller.

Impact

If _makeIncentives reverts, the function will continue execution without addressing the issue, leading to unpredictable behavior in state, and if it reverts after partial initialization, gas is wasted on operations that won't be completed. Lack of error propagation, making debugging difficult.

Since the _makeIncentives plays a critical role in setting up the incentives. Its importance lies in its ability to create a secure, flexible, and scalable system for managing incentives within the Boost protocol. An issue could potentially compromise the entire Boost creation process and the incentives themselves.

Code Snippet

https://github.com/sherlock-audit/2024-06-boost-aa-wallet/blob/main/boost-protocol/packages/evm/contracts/BoostCore.sol#L128

Tool used

Manual Review

Recommendation

1.Use a try-catch block to handle incentive creation attempts.

try BoostLib.Boost storage boost = _boosts.push();
    // ... rest of the function ...
catch Error(string memory reason) {
    revert BoostError.IncentiveCreationFailed(reason);
}

2. Modify _makeIncentives to propagate errors up the call stack.
3. Consider adding checks within _makeIncentives to prevent double initialization or other potential issues.
4. Review the overall architecture to ensure that partial failures in incentive creation don't compromise the integrity of the Boost.

These ensure that all failures are caught and handled, the function doesn't silently ignore failures and the caller receives the complete status of all incentives.