Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

No data is stored in the `locks` map

joicygiore

Summary

No data is stored in the locks map

Vulnerability Details

There is no data stored in mapping(address => Lock) public locks;, so the following function cannot correctly obtain account related data.

function getLockedBalance(address account) external view returns (uint256) {
@> return locks[account].amount;
}
​
function getLockEndTime(address account) external view returns (uint256) {
@> return locks[account].end;
}

Poc

Add the following test to test/unit/core/tokens/veRAACToken.test.js and execute it:

describe("check locks mapping", () => {
it("Poc", async () => {
const duration = 365 * 24 * 3600 * 4 ; // 4 year
// User[0] locks 100e18
await veRAACToken.connect(users[0]).lock(ethers.parseEther("100"), duration);
expect(await veRAACToken.getLockedBalance(users[0].address)).to.be.eq(0);
expect(await veRAACToken.getLockEndTime(users[0].address)).to.be.eq(0);
​
// User[0] increase 900e18
await veRAACToken.connect(users[0]).increase(ethers.parseEther("900"));
expect(await veRAACToken.getLockedBalance(users[0].address)).to.be.eq(0);
expect(await veRAACToken.getLockEndTime(users[0].address)).to.be.eq(0);
});
});

Impact

There is no data stored in mapping(address => Lock) public locks;, so the following function cannot correctly obtain account related data.

Tools Used

Manual Review

Recommendations

The corresponding data should be obtained from _lockState.locks

function getLockedBalance(address account) external view returns (uint256) {
- return locks[account].amount;
+ return _lockState.locks[account].amount;
}
​
function getLockEndTime(address account) external view returns (uint256) {
- return locks[account].end;
+ return _lockState.locks[account].end;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::getLockEndTime and getLockedBalance returns 0 by reading from unused locks mapping instead of _lockState, making lock expiry times unavailable to clients

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::getLockEndTime and getLockedBalance returns 0 by reading from unused locks mapping instead of _lockState, making lock expiry times unavailable to clients

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!