Skip to content

Latest commit

 

History

History
42 lines (21 loc) · 1.91 KB

File metadata and controls

42 lines (21 loc) · 1.91 KB

Scrawny Mustard Tadpole

Medium

Users Not Permitted For A Redeem , Might Loose Claims Due To Limit

Summary

When a user performs an action successfully he is permitted for a claim , but the incentives have a limit to them and if the limit is reached the claim will be reverted. Therefore , it's possible that the user completed the action succesfully but he wont be able to claim his incentive.

Vulnerability Detail

1.) Let's assume there is a boost with ERC20Incentive as the incentive , the limit set there is 50.

2.) It attracts a lot of users , they all perform the action the boost specified , lets assume a total of 100 users performed the action.

3.) Now when the users starts claiming here ->

https://github.com/sherlock-audit/2024-06-boost-aa-wallet/blob/main/boost-protocol/packages/evm/contracts/BoostCore.sol#L151

Only the 50 would be able claim there incentive because of the limit check here ->

https://github.com/sherlock-audit/2024-06-boost-aa-wallet/blob/main/boost-protocol/packages/evm/contracts/incentives/ERC20Incentive.sol#L132

4.) Therefore the other 50 of the users who completed the action successfully (can be anything form minting a costly NFT or spending some tokens) will not be able to claim there incentive and on top of this will not be redeemed for there action since there is no mechanism for redemptions. Therefore , these 50 users are left unincentivized for the same action performed as the first 50 users who claimed.

Impact

Users who were eligible for the claims neither got the incentive nor the redemption and lost funds while performing the action.

Code Snippet

https://github.com/sherlock-audit/2024-06-boost-aa-wallet/blob/main/boost-protocol/packages/evm/contracts/incentives/ERC20Incentive.sol#L132

Tool used

Manual Review

Recommendation

Have a redemption mechanism or dont let the users perform the action if the action has been performed by "limit" number of users.