Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`increase` does not verify for `MAX_TOTAL_SUPPLY`

pyro

Summary

increase does not verify for MAX_TOTAL_SUPPLY

Vulnerability Details

increase does not check if we are trying to make a lock with more than MAX_TOTAL_SUPPLY

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/tokens/veRAACToken.sol#L251

function increase(uint256 amount) external nonReentrant whenNotPaused {
//@audit not checked for, it's commented out inside `increaseLock` ...
// totalSupply() + amount > MAX_TOTAL_SUPPLY
​
// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);

We can see that it's missing from the above function, while also being commented out from the bellow one:

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/libraries/governance/LockManager.sol#L152

function increaseLock(
LockState storage state,
address user,
uint256 additionalAmount
) internal {
Lock storage lock = state.locks[user];
if (!lock.exists) revert LockNotFound();
if (lock.end <= block.timestamp) revert LockExpired();
​
if (lock.amount + additionalAmount > state.maxLockAmount) revert AmountExceedsLimit();
// Maximum total locked amount
// if (state.totalLocked + additionalAmount > state.maxTotalLocked) revert AmountExceedsLimit();
​
lock.amount += additionalAmount;
state.totalLocked += additionalAmount;
​
emit LockIncreased(user, additionalAmount);
}

Impact

  • The system max cap is breached.

  • Invariant is broken.

  • More voting power can be created beyond the maximum allocation, which may lead to fragmented governance or make proposals easier to pass. For example, if the minimum voting threshold is 30 million (30% of the cap) and the total voting power increases to 200 million, the threshold becomes easier to reach. This reduces the percentage of the user base required to approve a proposal, potentially enabling the passage of undesirable decisions.

Tools Used

Manual review

Recommendations

Uncoment the line.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doesn't check the token supply, making it possible to mint over the MAX

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!