Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Checkpoint Update in Emergency Withdraw

nourelden

Vulnerability Details

emergencyWithdraw()

function emergencyWithdraw() external nonReentrant {
// ... existing code ...
// Missing checkpoint update before burn
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
}
​

Root Cause

The emergencyWithdraw function fails to update voting power checkpoints when clearing a user's lock position, unlike the regular withdraw function that properly resets checkpoints:

// Regular withdraw
_checkpointState.writeCheckpoint(msg.sender, 0); // Present
​
// Emergency withdraw
// Missing checkpoint update
​

This creates divergent state handling between normal and emergency withdrawal paths.

Impact

  1. Governance Manipulation Risk

    • Withdrawn users retain historical voting power in checkpoints

    • Enables voting on past proposals using expired locks

    • Allows influencing governance decisions after token withdrawal

  2. Protocol State Inconsistency

    • Checkpoint data becomes out-of-sync with actual token balances

    • Breaks invariant: checkpointValue == actualVotingPower

    • Affects all systems relying on historical voting power snapshots

  3. Permanent Historical Record

    • Emergency-withdrawn positions remain in governance history

    • Cannot properly audit past voting power allocations

    • Creates false signals for reward distribution calculations

Recommendations

function emergencyWithdraw() external nonReentrant {
// ... existing checks ...
// Add checkpoint reset
_checkpointState.writeCheckpoint(msg.sender, 0);
// Existing burn/transfer logic
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::emergencyWithdraw doesn't update checkpoint - innacurate historical voting power, inconsistent state

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!