Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Total Supply Check in increase Function Allows Minting Beyond Limit

Fortis Audits

Summary

The increase function in veRAACToken.sol lacks a check for MAX_TOTAL_SUPPLY, allowing users to exceed the total supply limit of veRAACToken. While this check is correctly implemented in the lock function, users can bypass it by increasing their existing locked amount. This could lead to an inflationary scenario where the total supply exceeds the intended cap.

Vulnerability Details

Incorrect Behavior:

However, the increase function does not check if the total supply remains within the limit.

[ https://github.com/Cyfrin/2025-02- raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L251 ]

function increase(uint256 amount) external nonReentrant whenNotPaused {
//@audit-issue : No check for MAX_TOTAL_SUPPLY
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);
​
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_mint(msg.sender, newPower - balanceOf(msg.sender)); // No supply limit check
​
emit LockIncreased(msg.sender, amount);
}
​

  • This allows users who already have an active lock to mint more veRAAC tokens even if the total supply cap is reached.

Impact

  • Unintended Inflation: The total supply of veRAACToken can exceed MAX_TOTAL_SUPPLY, breaking supply constraints.

  • Economic Imbalance: If supply exceeds the designed cap, it may impact governance voting power and incentives.

Tools Used

Manual Review

Recommendations

Add a total supply check in the increase function, similar to the one in lock:

function increase(uint256 amount) external nonReentrant whenNotPaused {
++ if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);
​
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_mint(msg.sender, newPower - balanceOf(msg.sender)); // No supply limit check
​
emit LockIncreased(msg.sender, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doesn't check the token supply, making it possible to mint over the MAX

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.