Submission Details
Severity:
Missing check for MAX_TOTAL_LOCKED_AMOUNT in voting escrow
Summary
The protocol defines a maximum amount that can be globally locked as per the following:
/**
* @notice Maximum total amount that can be locked globally
*/
uint256 public constant MAX_TOTAL_LOCKED_AMOUNT = 1_000_000_000e18; // 1B
However this is not been checked when creating or increasing the locks.
Vulnerability Details
Impact
Unrestricted maximum locked amount.
Tools Used
Manual review.
Recommendations
When a user changes their lock state check that the maximum amount is not exceeded.
Updates
Lead Judging Commences
inallhonesty 2 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::increase doesn't check the maximum total locked amount
`veRAACToken::lock` function doesn't check MAX_TOTAL_LOCKED_AMOUNT
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.