Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Checkpoint Update in emergencyWithdraw leading to incorrect fetching of Voting Power

buggsyes

Summary

The emergencyWithdraw function in veRAACToken.sol allows users to withdraw their locked tokens prematurely during emergencies.
However, this function does not update the checkpoint of the user's voting power after burning their veTokens.
that will lead to incorrect fetching of past voting power and totalVotingPower in the protocol.

Vulnerability Details

Due to the missing checkpoint update, the protocol will still consider the user's voting power as the last checkpointed because inEmergencyWithdraw when the user Withdraws his RaacTokens and his VeraacTokens are burned his voting power persists in _checkpointState because its not reseted as in withdraw with _checkpointState.writeCheckpoint(msg.sender, 0); .

function emergencyWithdraw() external nonReentrant {
if (emergencyWithdrawDelay == 0 || block.timestamp < emergencyWithdrawDelay)
revert EmergencyWithdrawNotEnabled();
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert NoTokensLocked();
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
> missing checkpoint
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
emit EmergencyWithdrawn(msg.sender, amount);
}
​
​

Impact

whenever the protocol wants to fetch past Voting power for a user or TotalVotingPower for that period it will be innacurate as the user's voting balance will not be updated properly as 0 after the emergencyWithdraw , which can influence Voting calculations and past Snapshots .

functions that will fetch incorrect data for the protocol :
https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L437-L440
https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/governance/PowerCheckpoint.sol#L104-L113
https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/governance/PowerCheckpoint.sol#L121-L129
https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/governance/PowerCheckpoint.sol#L156-L163

Tools Used

manual review

Recommendations

Update checkpoint during emergencyWithdraw as in Withdraw .

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::emergencyWithdraw doesn't update checkpoint - innacurate historical voting power, inconsistent state

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!