Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

User can permament DoS of minting VeraacToken

zukanopro

Vulnerability Details

In veRAACTokencontract, when user increase amount of locked token, they will mint some token for caller:

function increase(uint256 amount) external nonReentrant whenNotPaused {
// Increase lock using LockManager
@> _lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
@> (int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);
​
// Update checkpoints
@> uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
// Transfer additional tokens and mint veTokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
@> _mint(msg.sender, newPower - balanceOf(msg.sender));
​
emit LockIncreased(msg.sender, amount);
}

It can be seen that minting amount is based on newPower and current balance of user, and newPower is calculated based on locked amount and unlock time.

And this token allow user to burn token:

function transfer(address to, uint256 amount) public virtual override(ERC20, IveRAACToken) returns (bool) {
return super.transfer(to, amount);
}
​
function _update(
address from,
address to,
uint256 amount
) internal virtual override {
@> if (from == address(0) || to == address(0)) {
// Allow minting and burning operations
super._update(from, to, amount);
return;
}
// Prevent all other transfers of veRAAC tokens
revert TransferNotAllowed();
}

And there is total supply of token:

uint256 private constant MAX_TOTAL_SUPPLY = 100_000_000e18; // 100M

So the attacker can fulfill total supply of token by lock some amount, continuously burning them by transfer to address(0)and increase some amount

Impact

No more token can be locked. And in governance, quorum is calculated based on totalSupply of Veraactoken. So if attacker mint too many token to address(0), it is hard/or impossible to have succeeded proposal due to lack of token that can be used by other users to vote. Or in worst scenario, if attacker have 4M token, all others user do not have 4M token, attacker can use this attack vector to create a sure-win proposal.

Recommendations

Do not allow burning token by transfer them to address(0)

Updates

Lead Judging Commences

inallhonesty Lead Judge
9 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!