Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`veRAACToken::emergencyWithdraw` doesn't have any cleaning mechanism to remove emergency schedules previously set, allowing users to perform withdraws at will before the lock ends.

77SecMentees

Summary

veRAACToken implements a mechanism to permit users to withdraw their locked tokens under emergency scenarios. The emergency is enabled by the veRAACToken::enableEmergencyWithdrawand can be performed any time after the emergencyWithdrawDelay.

Vulnerability Details

Although this is a good practice, the function doesn't implement any functionality to reset the emergencyWithdrawDelayvariable. This means that after the emergencyWithdrawDelayusers will always be able to perform withdraws.

function emergencyWithdraw() external nonReentrant {
if (emergencyWithdrawDelay == 0 || block.timestamp < emergencyWithdrawDelay)
revert EmergencyWithdrawNotEnabled();
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert NoTokensLocked();
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
emit EmergencyWithdrawn(msg.sender, amount);
}

Once the emergency ends and users can start depositing again, they would be able to immediately withdraw if they want to.

Impact

All locked tokens could be redeemed by users before the MIN_LOCK_DURATIONends even after the emergency action is finalized.

Tools Used

Code Review

Recommendations

Implement a function to reset the emergencyWithdrawDelayvariable once the emergency scenario comes to an end.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::emergencyWithdraw permanently enables lock-bypassing after activation with no way to disable it, permanently breaking token time-locking functionality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!