Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Wrong parameter passed to `_updateBoostState` in `increase` function in veRAACToken contract.

tadev

Summary

increase function in veRAACToken contract is defined as follows:

function increase(uint256 amount) external nonReentrant whenNotPaused {
// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
// @audit LOW: should use _lockstate.locks[msg.sender]
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) =
_votingState.calculateAndUpdatePower(msg.sender, userLock.amount + amount, userLock.end);
​
// Update checkpoints
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
// Transfer additional tokens and mint veTokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_mint(msg.sender, newPower - balanceOf(msg.sender));
​
emit LockIncreased(msg.sender, amount);
}

The issue arises because locks[msg.sender].amount is passed to _updateBoostState in this function. The problem is that locks storage mapping is defined but never used apart from this place. It is only used in 2 getter functions:

// @audit: useless function `locks` storage variable not used
function getLockedBalance(address account) external view returns (uint256) {
return locks[account].amount;
}
​
// @audit: useless function `locks` storage variable not used
function getLockEndTime(address account) external view returns (uint256) {
return locks[account].end;
}
​

Instead of passing locks[msg.sender].amount to _updateBoostState internal function, _lockstate.locks[msg.sender] should be passed, as _lockstate is the variable that holds the state of locks.

Impact

The impact of this issue is low as this parameter is in fact never used by the _updateBoostState function. But such a discrepancy in the input parameter should be noticed.

Tools Used

Manual review.

Recommendations

Make sure to pass _lockstate.locks[msg.sender] instead of locks[msg.sender].amount to _updateBoostState internal function in increase function.

Also, update getter functions getLockedBalance and getLockEndTime accordingly.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase uses locks[msg.sender] instead of _lockState.locks[msg.sender] inside _updateBoostState call

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!