Users can extend an expired boost using invalidated NFTs.
In `Goldilend.sol#L251`, a user can extend a boost with invalidated NFTs.\\nThe user has created a boost with a valid NFT.\\nAfter that, the NFT was invalidated using `adjustBoosts()`.\\nAfter the original boost is expired, the user can just call `boost()` with empty arrays, and the boost will be extended again with the original magnitude.\\n```\\n  function _buildBoost(\\n    address[] calldata partnerNFTs,\\n    uint256[] calldata partnerNFTIds\\n  ) internal returns (Boost memory newUserBoost) {\\n    uint256 magnitude;\\n    Boost storage userBoost = boosts[msg.sender];\\n    if(userBoost.expiry == 0) {\\n// rest of code\\n    }\\n    else {\\n      address[] storage nfts = userBoost.partnerNFTs;\\n      uint256[] storage ids = userBoost.partnerNFTIds;\\n      magnitude = userBoost.boostMagnitude; //@audit use old magnitude without checking\\n      for (uint256 i = 0; i < partnerNFTs.length; i++) {\\n        magnitude += partnerNFTBoosts[partnerNFTs[i]];\\n        nfts.push(partnerNFTs[i]);\\n        ids.push(partnerNFTIds[i]);\\n      }\\n      newUserBoost = Boost({\\n        partnerNFTs: nfts,\\n        partnerNFTIds: ids,\\n        expiry: block.timestamp + boostLockDuration,\\n        boostMagnitude: magnitude\\n      });\\n    }\\n  }\\n```\\n
Whenever users extend their boosts, their NFTs should be evaluated again.
Malicious users can use invalidated NFTs to extend their boosts forever.
```\\n  function _buildBoost(\\n    address[] calldata partnerNFTs,\\n    uint256[] calldata partnerNFTIds\\n  ) internal returns (Boost memory newUserBoost) {\\n    uint256 magnitude;\\n    Boost storage userBoost = boosts[msg.sender];\\n    if(userBoost.expiry == 0) {\\n// rest of code\\n    }\\n    else {\\n      address[] storage nfts = userBoost.partnerNFTs;\\n      uint256[] storage ids = userBoost.partnerNFTIds;\\n      magnitude = userBoost.boostMagnitude; //@audit use old magnitude without checking\\n      for (uint256 i = 0; i < partnerNFTs.length; i++) {\\n        magnitude += partnerNFTBoosts[partnerNFTs[i]];\\n        nfts.push(partnerNFTs[i]);\\n        ids.push(partnerNFTIds[i]);\\n      }\\n      newUserBoost = Boost({\\n        partnerNFTs: nfts,\\n        partnerNFTIds: ids,\\n        expiry: block.timestamp + boostLockDuration,\\n        boostMagnitude: magnitude\\n      });\\n    }\\n  }\\n```\\n