Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Excess veRAAC tokens minted to users when increasing lock

tigerfrake

Summary

The increase() function calculates new voting power using userLock.amount + amount, which effectively counts the additional amount twice. This leads to incorrect minting of veRAAC tokens, as users receive more tokens than they should based on their actual lock.

Vulnerability Details

increase() is implemented as follows:

function increase(uint256 amount) external nonReentrant whenNotPaused { //@audit
// @audit-info Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
>> userLock.amount + amount, // @audit-issue double incremented
userLock.end
);
​
// @audit-issue new power
uint256 newPower = uint256(uint128(newBias));
---SNIP---
// @audit-issue Incorretc amount minted here
>> _mint(msg.sender, newPower - balanceOf(msg.sender));
​
emit LockIncreased(msg.sender, amount);
}

Here, the _lockState.increaseLock() already updates the user's lock amount by adding the additionalAmount:

lock.amount += additionalAmount;

However, calculation of the new voting power uses userLock.amount + amount as the input to _votingState.calculateAndUpdatePower().

This means that userLock.amount + amount effectively counts the additional amount twice.

Impact

As a result of this redundancy, the calculation for newBias (which is used to determine how many veRAAC tokens to mint) will be based on an inflated amount. As such, user will receive more veRAAC tokens than they should, leading to an incorrect distribution of voting power.

Tools Used

Manual Review

Recommendations

The calculation for newBias should use the updated lock amount directly from the state after the increase has been applied.

(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
- userLock.amount + amount,
+ userLock.amount, // @audit Use the updated amount directly
userLock.end
);
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doubles the voting power of users

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!