Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

totalLocked amount validation not enforced at veRAACToken::increase()

oxaudron

Summary

There are two invariants for locking up amounts :

  • Maximum locked up amount for single position shouldn't be more than a specified threshold : 10_000_000e18

  • Maximum locked up amount for cumulative position shouldn't be more than a specified threshold : MAX_TOTAL_LOCKED_AMOUNT
    However its not enforced when the user tries to increase his position amount.

Vulnerability Details

This is the increase() function in the veRAACToken which is used by the user to increase their position :

function increase(uint256 amount) external nonReentrant whenNotPaused {
// Increase lock using LockManager
@> _lockState.increaseLock(msg.sender, amount);

There is no validation in the external function above, and it calls an underlying function. The underlying code of _lockState.increaseLock has the code written for which is validating totalLocked amount, however it's commented out :

function increaseLock(
LockState storage state,
address user,
uint256 additionalAmount
) internal {
Lock storage lock = state.locks[user];
if (!lock.exists) revert LockNotFound();
if (lock.end <= block.timestamp) revert LockExpired();
// Maximum lock amount
if (lock.amount + additionalAmount > state.maxLockAmount) revert AmountExceedsLimit();
//@audit maximum totalLocked amount not checked since the code is commented out
// Maximum total locked amount
@> // if (state.totalLocked + additionalAmount > state.maxTotalLocked) revert AmountExceedsLimit();
lock.amount += additionalAmount;
state.totalLocked += additionalAmount;
​
emit LockIncreased(user, additionalAmount);
}

Attack scenario:

  • Suppose that totalLocked amount is already 999_900_000e18

  • Attacker increase their position by 10_000_000e18

  • totalLocked will surpass 1_000_000_000e18

Impact

  • Break the invariant of 1 billion reserve

Tools Used

Manual Review

Recommendations

  • Uncomment the code to perform the validation

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doesn't check the maximum total locked amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!