Core Contracts

Summary

MAX_TOTAL_SUPPLY limitation can be bypassed

Vulnerability Details

In veRAACToken, there is one MAX_TOTAL_SUPPLY limitation. We use this limitation to limit the maximum supply for veRAAC Token. When we lock one position, we will check this limitation to make sure that the total veRAAC token supply cannot exceed MAX_TOTAL_SUPPLY.

The problem is that when users increase one existing position or extend one existing position, it's possible to mint some extra veRAAC tokens. But we miss to check this MAX_TOTAL_SUPPLY limitation check in both increase() and extend().

Impact

The MAX_TOTAL_SUPPLY limitation can be bypassed via increase() or extend().

Tools Used

Manual

Recommendations

Add the related cap check in the increase() and extend().