Core Contracts

Summary & Vulnerability Details

In the veRAACToken contract, the lock function attempts to limit the total minted supply by comparing totalSupply() + amount to a maximum threshold, MAX_TOTAL_SUPPLY. The goal is to ensure that the total supply of veRAACToken never exceeds 100,000,000e18

Here, amount represents the user’s deposited assets(raacToken) to acquire veRAACToken, but this deposit value is not necessarily in a 1:1 ratio with the actual veRAACToken minted. Consequently, using amount directly in this check causes the total supply limit validation to be incorrect. The function does not accurately enforce the intended maximum total supply limit, potentially allowing the real total supply of veRAACToken to exceed MAX_TOTAL_SUPPLY.

Impact

Because the total supply check relies on a potentially misleading parameter (amount), the mechanism to prevent over-minting is ineffective.Attackers or users could use this flaw to mint more tokens than intended by the contract’s design, undermining trust and stability of the protocol.

Tools Used

Manual review of veRAACToken.sol

Recommendations

To accurately enforce the maximum supply constraint, move the total supply check to occur immediately after the _mint call. For example: