Core Contracts

Summary

The function lock in the veRAACToken contract allows users to create a new lock position without checking if they have an existing unexpired lock. This overwrites the previous lock position, causing any previously locked tokens to become permanently lost.

Vulnerability Details

The vulnerability in lock exits because there is no check to see if the user has an already existing lock, even though the function directly overwrites the existing lock.

Here's an example of how this can go wrong:

• User locks 1M tokens for 1 year

• User locks another 1M tokens before his last lock expires

• The amount from the first lock is lost because the struct gets overwritten

Impact

As a result, the tokens a user locks become permanently locked in the contract, with no way of recovery, which undermines the user's trust in the protocol.

Recommendations

Consider adding a check in lock checking if there's currently an existing lock. The new lock should be possible after the previous tokens are withdrawn either through withdraw or emergencyWithdraw.