Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

incorrect erc20 balance used in veRAACToken

maa_ly

Summary

The veRAAC token's balanceOf returns the initial voting power based on the lock amount and duration, but voting power decays over time. However, the ERC20 balance doesn't decrease as time passes. So if a user's voting power should decrease because their lock is halfway through, balanceOf still shows the full amount. Any functionality relying on balanceOf, like boost calculations, would use outdated values. For example, a user might get a higher boost than deserved because their balance hasn't decayed. This leads to unfair advantages in reward distribution or governance voting.

Vulnerability Details

Static balance accounting conflicts with dynamic voting power:

// Voting power decays but balance remains fixed
_mint(msg.sender, newPower); // Initial power stored as ERC20 balance
​
function getVotingPower(...) {
// Dynamic calculation not reflected in ERC20
return actualDecayingPower;
}

poc

function testBoost_IncorrectBalance() public {
// Lock for max duration
address alice = makeAddr("alice");
uint256 someAmount = 200e18;
deal(alice, someAmount);
vm.prank(owner);
mockraac.mintTo(alice, someAmount);
​
vm.startPrank(alice);
mockraac.approve(address(raacToken), 100e18);
raacToken.lock(100e18, 1460 days);
vm.stopPrank();
​
// After 2 years
vm.warp(block.timestamp + 730 days);
​
// ERC20 balance remains at initial value
uint256 balance = raacToken.balanceOf(alice);
uint256 actualPower = raacToken.getVotingPower(alice);
assertGt(balance, actualPower); // Balance hasn't decayed
}

Impact

Reward Distortion: Staking rewards based on incorrect balances

Governance Attack Surface: Voting with expired power

UI/UX Deception: Users see incorrect token balances than they actuall have

Tools Used

manual review, foundry

Recommendations

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!