Core Contracts

Summary

The LockManager library defines a maxTotalLocked variable, which is intended to restrict the total amount of locked tokens. However, this limit is not enforced in the code, allowing users to exceed the intended cap.

Vulnerability Details

Expected Behavior (as per Documentation)

The LockState struct includes maxTotalLocked, which is described in the documentation as follows:

maxTotalLocked – Maximum total amount of tokens that can be locked

Additionally, the Usage Notes section of the documentation states:

Maximum lock amounts per position and globally can be configured in LockState.

This clearly suggests that maxTotalLocked should be enforced to restrict the global token lock limit.

Actual Behavior (Test Findings)

Despite being defined in the struct, maxTotalLocked is never actually enforced in createLock or increaseLock. This means that users can exceed the global lock cap without any restrictions.

Failing Test (Expected to Revert, but It Didn't)

• The test expected a revert because the second lock exceeded maxTotalLocked (15 tokens total vs. 10 + 10 = 20).

• No error was thrown, confirming that maxTotalLocked is not enforced in the contract.

• Since maxLockAmount (per-user limit) is enforced but maxTotalLocked is not, this creates an inconsistency in validation logic.

Impact

• Severity: Low

• No direct loss of funds, but the system does not behave as intended based on the documentation.

• If token locking is used for governance, staking, or economic modeling, this could disrupt the system's design.

• Users can lock unlimited tokens, bypassing restrictions.

Tools Used

Hardhat

Recommendations

To enforce maxTotalLocked, add the following check inside createLock and increaseLock: