Core Contracts

Summary

The lock() function calls createLock() without verifying if the user already has an existing lock. If a user attempts to lock tokens while they already have an active lock, the new lock will overwrite the existing one.

Vulnerability Details

In lock(), a user provides an amount of raacTokens they wish to lock and duration of lock which is then handled as follows:

In createLock(), the user's lock position is created as follows:

However, before proceeding to create this position, the exists field is not checked in lock() . This means that if a user attempts to lock tokens while they already have an active lock, the new lock will replace the existing one.

Impact

This leads to a scenario where the old locked funds are erased resulting is a condition where the user has a lock position that does not accurately reflect his total lock. This therefore translates to loss for the user

Tools Used

Manual Review

Recommendations

Check if the user already has an existing lock before creating a new one in lock():