Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Inadequate check of `MAX_TOTAL_SUPPLY` when minting `veRaac`

OpaBatyo

Summary

MAX_TOTAL_SUPPLY will revert when it shouldn't due to summing locked RAAC with minted veRAAC

Details

Let's observe the lock method's sanity checks

function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
if (amount == 0) revert InvalidAmount();
if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit();
@> if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
}

We see that the check against MAX_TOTAL_SUPPLY is performed by summing 2 entirely different numbers. One is the total supply of veTokens while the other is the desired lock amount, expressed in RAAC token. veToken minting is proportional to the lock amount and duration as user is minted the bias derived from calculateAndUpdatePower

function calculateAndUpdatePower(
VotingPowerState storage state,
address user,
uint256 amount,
uint256 unlockTime
) internal returns (int128 bias, int128 slope) {
if (amount == 0 || unlockTime <= block.timestamp) revert InvalidPowerParameters();
uint256 MAX_LOCK_DURATION = 1460 days;
uint256 duration = unlockTime - block.timestamp;
@> uint256 initialPower = (amount * duration) / MAX_LOCK_DURATION;
@> bias = int128(int256(initialPower));
slope = int128(int256(initialPower / duration));
uint256 oldPower = getCurrentPower(state, user, block.timestamp);
state.points[user] = RAACVoting.Point({
bias: bias,
slope: slope,
timestamp: block.timestamp
});
_updateSlopeChanges(state, unlockTime, 0, slope);
return (bias, slope);
}

If a user locks 100 raac tokens for 2 years, they will get minted 50 veRaac hence why summing the 2 will be problematic.
Now assume the MAX_TOTAL_SUPPLY = 1000 and veToken.totalSupply = 950. The user from the example above knows this and wants to lock 100 raac for 2 years in order to get 50 veRaac and fill the buffer. His lock attempt will revert since 950 + 100 > 1000

Impact

Logic error, unexpected behaviour

Mitigation

Perform the check using the actual minted amount, not the locked one

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect `MAX_TOTAL_SUPPLY` check in the `veRAACToken::lock/extend` function of `veRAACToken` could harm locking functionality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!