Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect total supply check in veRAAC token

x1485967

Summary

The total supply cap check is incorrect in veRAACToken::lock().

Vulnerability Details

In veRAACToken, we have one limitation as below. The owner wants to set one cap for the total veRAAC token based on the comments. We should notice that MAX_TOTAL_SUPPLY and MAX_TOTAL_LOCKED_AMOUNT are different. MAX_TOTAL_SUPPLY is one cap for the total veRAAC token. And MAX_TOTAL_LOCKED_AMOUNT is the total locked RAAC token amout.

/**
* @notice Maximum total supply of veRAACToken
*/
uint256 private constant MAX_TOTAL_SUPPLY = 100_000_000e18; // 100M
/**
* @notice Maximum total amount that can be locked globally
*/
uint256 public constant MAX_TOTAL_LOCKED_AMOUNT = 1_000_000_000e18; // 1B
​

The problem is that we use amount(locked RAAC token amount) to check the MAX_TOTAL_SUPPLY limitation incorrectly. We should use newPower(newly minted veRAAC token amount) to check MAX_TOTAL_SUPPLY.

function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
if (amount == 0) revert InvalidAmount();
if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit();
if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
...
​
_mint(msg.sender, newPower);
​
emit LockCreated(msg.sender, amount, unlockTime);
}

Impact

Incorrect max supply check. This may cause that normal lock transaction will be reverted.
For example: Alice locks 10000 RAAC for 1 years. Then the minted veRAAC amount should be 2500 RAAC. If the totalSupply() + amount > MAX_TOTAL_SUPPLY, this may cause that normal lock will be blocked incorrectly.

Tools Used

Manual

Recommendations

Use newPower to check the MAX_TOTAL_SUPPLY limitation.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect `MAX_TOTAL_SUPPLY` check in the `veRAACToken::lock/extend` function of `veRAACToken` could harm locking functionality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.