Was this helpful?
Submitted on Mar 14th 2025 at 13:21:51 UTC by @DoD4uFN for
Report ID: #41374
Report Type: Smart Contract
Report severity: Insight
Target: https://github.com/immunefi-team/audit-comp-yeet/blob/main/src/Yeet.sol
Impacts:
Contract fails to deliver promised returns, but doesn't lose value
The nftBoostLookup array in the Yeet contract contains an incorrect boost value for users holding 11 Yeetard NFTs. Instead of the intended boost of 11.1% (represented as 1110 in a 10000 scale), the array sets the value at 1100. This discrepancy can lead to slightly lower rewards for affected users, undermining the fairness of the reward distribution mechanism.
The contract uses the nftBoostLookup array to determine the boost percentage based on the number of NFTs a user holds. The array is defined as follows:
The intended boost mechanism, as described in the documentation, applies a concave curve to limit the rewards of large NFT holders, capping the maximum boost at 15% for 25 NFTs. For 11 NFTs, the expected boost is 11.1% (1110), not 11.0% (1100).
The immediate impact is that users holding 11 NFTs will receive a 0.1% lower boost on their yeet rewards than expected, potentially reducing their reward share over multiple rounds. Although the absolute difference might appear minimal, in aggregate over many epochs and among a large user base, this miscalculation can lead to discrepancies in reward distribution.
Here is the documentation about the percentages of boosts depending on the number of NFTs: https://docs.yeetit.xyz/yeet/yeet-game/nftboostweight
and here is the relevant line of code: https://github.com/immunefi-team/audit-comp-yeet/blob/da15231cdefd8f385fcdb85c27258b5f0d0cc270/src/Yeet.sol#L199
The nftBoostLookup array in the Yeet contract determines the boost percentage applied to rewards based on the number of NFTs a user holds. Each index in the array corresponds to the number of NFTs, and the stored value represents the percentage boost multiplied by 100 (e.g., 11.1% is stored as 1110).
According to the project documentation, a user holding 11 NFTs should receive a boost of 11.1% (1110). However, the contract incorrectly assigns a value of 1100, which corresponds to an 11.0% boost.
Incorrect implementation:
Set up the environment: Deploy the Yeet contract and ensure it contains the nftBoostLookup array as specified.
Hold 11 NFTs: A test account should acquire exactly 11 Yeetard NFTs.
Check the applied boost: Retrieve the boost value using the contract function that references nftBoostLookup.
Compare expected vs. actual output: The contract will return 1100 instead of 1110, indicating a 0.1% discrepancy.
Users holding exactly 11 NFTs will receive 11.0% instead of 11.1% boost on their rewards, leading to slightly lower returns.
The fix involves updating the nftBoostLookup array to reflect the correct value at index 11:
This ensures the contract applies the correct 11.1% boost, maintaining consistency with the documented behavior and ensuring fair rewards distribution.
