Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

RAACTokens will be locked due to overwritten locks in veRAACToken contract

newspacexyz

Summary

The veRAACToken#lock() allows users to create a lock for their RAACTokens, granting them voting power. However, the function does not check whether the user already has an existing lock. As a result due to overwrite the previous lock, it will lead the loss of previously locked funds.

Vulnerability Details

If a user already has a lock and calls lock() again, the old lock is replaced with a new one.

The previously locked tokens remain in the contract but become inaccessible to the user.

There is no way for the user to withdraw or recover these locked funds even transfer is unavailable in _update().

Proof Of Code

Testcode is written in veRAACToken.test.js

describe("Newspace POC", () => {
it("double lock creation", async () => {
const amount1 = ethers.parseEther("1000");
const amount2 = ethers.parseEther("2000");
const duration = 365 * 24 * 3600;
await veRAACToken.connect(users[0]).lock(amount1, duration);
await veRAACToken.connect(users[0]).lock(amount2, duration);
// Verify lock position
const position = await veRAACToken.getLockPosition(users[0].address);
expect(position.amount).to.equal(amount2);
});
});

As seen in the POC, first lock amount1 is overwritten by second lock amount2 and user has only second lock amount2.

Impact

User's RAACTokens are locked

Tools Used

manual, hardhat

Recommendations

Modify the lock() function to reject users who already have a lock and instruct them to use increaseLock() instead.

function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
+ if (_lockState.locks[msg.sender].exists) revert("Lock already exists, use increaseLock()");
if (amount == 0) revert InvalidAmount();
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::lock called multiple times, by the same user, leads to loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!