Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

User can maintain his `veRAAC` lock duration at 4 years, this way keeping a constant voting power

kirobrejka

Summary

This is possible due to the following line in the LockManager::extendLock function:

function extendLock(
LockState storage state,
address user,
uint256 extensionDuration
) internal returns (uint256 newEnd) {
Lock storage lock = state.locks[user];
if (!lock.exists) revert LockNotFound();
if (lock.end <= block.timestamp) revert LockExpired();
// Calculate remaining duration from current lock
@> uint256 remainingDuration = lock.end - block.timestamp;
// Calculate total new duration (remaining + extension)
@> uint256 totalNewDuration = remainingDuration + extensionDuration;
// Check if total duration exceeds max lock duration
@> if (totalNewDuration > state.maxLockDuration) revert InvalidLockDuration();

Vulnerability Details

This is bad because user can constantly maintain the same voting power over time, which will imediately make an impact everywhere the veRAACToken::getVotingPower function is used. The vulnerability lies in the fact that a user can always extend his remaining lock duration to be 4 years, making his voting power as high as possible every time he do so, practically resulting in never ending lock

Impact

User can maintain his voting power as high as possible with no time boundaries. He also can exceed the maximum lock duration of 4 years

Tools Used

Manual Review

Recommendations

Take the passed lock duration into account and check if the passed duration + remaining duration + extension duration exceed 4 years. This can be done in the `veRAACToken::extend` function as well

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Appeal created

kirobrejka Submitter
7 months ago
inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!