Core Contracts

Summary

The lock function is used to create new locks, issue is that the contract doesn't check if there's an existing lock for the user. That means if Alice locks 100 tokens for a year and then later locks another 50 tokens for two years, the second call overwrites her first lock. She loses her initial 100 tokens because the contract replaces the old lock with the new one. The RAAC tokens from the first lock are still in the contract, but her lock structure now points to the new amount and duration. She can't withdraw the original 100 tokens anymore because the contract thinks she only locked 50.

I am aware that increase function is used to increase the lock amount, but if a user blindly uses lock after already locking, there should be a check that prevents them from overwriting their lock.

Vulnerability Details

The lock creation mechanism lacks state validation checks. The lock function accepts new lock positions without verifying existing commitments:

poc

Impact

Previous locked amounts become permanently inaccessible as contract state gets overwritten.

Tools Used

manual review, foundry

Recommendations

check if user has existing lock before creating a new one
require(locks[msg.sender].amount == 0)