Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Double lock will not increase voting power

glightspeed2

Summary

When a user locks in veRAACToken for a second time, existing lock position will be overwritten by the new position. This will lead to invalid voting power calculation and total supply of veRAACToken.

Vulnerability Details

The following is veRAACToken.lock implementation:

function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
if (amount == 0) revert InvalidAmount();
if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit();
if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
if (duration < MIN_LOCK_DURATION || duration > MAX_LOCK_DURATION)
revert InvalidLockDuration();
​
// Do the transfer first - this will revert with ERC20InsufficientBalance if user doesn't have enough tokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Calculate unlock time
uint256 unlockTime = block.timestamp + duration;
// Create lock position
@> _lockState.createLock(msg.sender, amount, duration); // @audit existing lock will be replaced by new lock
_updateBoostState(msg.sender, amount);
​
// Calculate initial voting power
(int128 bias, int128 slope) = _votingState.calculateAndUpdatePower(
msg.sender,
amount,
unlockTime
);
​
// Update checkpoints
uint256 newPower = uint256(uint128(bias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
// Mint veTokens
@> _mint(msg.sender, newPower); // @audit veToken is minted to user again
​
emit LockCreated(msg.sender, amount, unlockTime);
}

The problem is that, when the user locks for a second time, existing lock state will be overwritten by new lock state.
Moreover, user will get veToken minted according to newPower.

This will result in discrepancy between veToken balance and voting power.

Impact

There will be discrepancy between veToken balance and voting power. i.e. for double-locked users, they will have higher veToken balance than actual voting power.

Recommendation

Prevent double lock.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::lock called multiple times, by the same user, leads to loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!