Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Voting Power Calculation in Increase Lock Function in veRAACToken contract

kkk

Summary

In the increase function of the veRAACToken contract, the calculation of new voting power incorrectly adds the additional amount to the user’s current lock amount, even though the increase has already been applied by the increaseLock function. This results in an overestimation of the updated voting power.

Vulnerability Details

The following code snippet highlights the issue:

// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount); // amount added
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount, // <- FOUND
userLock.end
);

Issue Explanation:

• Double Counting: The function increaseLock already updates the lock’s amount by adding the new tokens. Thus, adding amount again in the call to _votingState.calculateAndUpdatePower results in double counting the additional tokens.

• Incorrect Voting Power: This miscalculation leads to an inflated new voting power (i.e., newBias), which may distort governance calculations and reward distributions.

function increaseLock( //
LockState storage state,
address user,
uint256 additionalAmount
) internal {
Lock storage lock = state.locks[user];
if (!lock.exists) revert LockNotFound();
if (lock.end <= block.timestamp) revert LockExpired();
// Maximum lock amount
if (lock.amount + additionalAmount > state.maxLockAmount) revert AmountExceedsLimit();
// Maximum total locked amount
// if (state.totalLocked + additionalAmount > state.maxTotalLocked) revert AmountExceedsLimit();
lock.amount += additionalAmount; // <- already added to amount
state.totalLocked += additionalAmount;
​
emit LockIncreased(user, additionalAmount);
}

Impact

Increase amount is double each time user call for increase function.

• Governance Misrepresentation: Users may receive disproportionate voting power relative to their actual locked tokens, potentially impacting voting outcomes.

• Economic Discrepancies: Overestimated voting power could affect reward distributions and undermine the intended tokenomics of the system.

Tools Used

Manual

Recommendations

• Correct the Calculation: Update the voting power calculation to use the updated userLock.amount without adding the amount again. For example:

(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount, // Use the updated lock amount, as increaseLock already adds the additional amount
userLock.end
);
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doubles the voting power of users

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!