Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Wrong parameter passed to `_updateBoostState` in `increase` function in veRAACToken contract.

tadev

Summary

increase function in veRAACToken contract is defined as follows:

function increase(uint256 amount) external nonReentrant whenNotPaused {
// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
// @audit LOW: should use _lockstate.locks[msg.sender]
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) =
_votingState.calculateAndUpdatePower(msg.sender, userLock.amount + amount, userLock.end);
​
// Update checkpoints
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
// Transfer additional tokens and mint veTokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_mint(msg.sender, newPower - balanceOf(msg.sender));
​
emit LockIncreased(msg.sender, amount);
}

The issue arises because locks[msg.sender].amount is passed to _updateBoostState in this function. The problem is that locks storage mapping is defined but never used apart from this place. It is only used in 2 getter functions:

// @audit: useless function `locks` storage variable not used
function getLockedBalance(address account) external view returns (uint256) {
return locks[account].amount;
}
​
// @audit: useless function `locks` storage variable not used
function getLockEndTime(address account) external view returns (uint256) {
return locks[account].end;
}
​

Instead of passing locks[msg.sender].amount to _updateBoostState internal function, _lockstate.locks[msg.sender] should be passed, as _lockstate is the variable that holds the state of locks.

Impact

The impact of this issue is low as this parameter is in fact never used by the _updateBoostState function. But such a discrepancy in the input parameter should be noticed.

Tools Used

Manual review.

Recommendations

Make sure to pass _lockstate.locks[msg.sender] instead of locks[msg.sender].amount to _updateBoostState internal function in increase function.

Also, update getter functions getLockedBalance and getLockEndTime accordingly.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase uses locks[msg.sender] instead of _lockState.locks[msg.sender] inside _updateBoostState call

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!