Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing `totalLocked` Updates in `withdraw()` Allow System Lockout and Affect Governance Calculations

0xmystery

Summary

Assuming that the System-Wide Locking Limit (maxTotalLocked) issue has been fixed,as I have separately reported, a new issue arises:

  • When users withdraw their locked tokens, totalLocked is not decremented, leading to incorrect balance tracking.

  • New users cannot lock tokens after withdrawals if totalLocked has reached maxTotalLocked. Neither can existing users increase lock tokens.

  • Associated governance calculations will also be affected.

Vulnerability Details

When users withdraw their locked tokens, totalLocked remains unchanged, as evidenced of the missing update in the code logic of `veRAACToken.withdraw()`:

veRAACToken.sol#L307-L332

/**
* @notice Withdraws locked RAAC tokens after lock expiry
* @dev Burns veRAAC tokens and returns the original RAAC tokens to the user
*/
function withdraw() external nonReentrant {
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert LockNotFound();
if (block.timestamp < userLock.end) revert LockNotExpired();
​
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
​
// Clear lock data
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
​
// Update checkpoints
_checkpointState.writeCheckpoint(msg.sender, 0);
​
// Burn veTokens and transfer RAAC
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
emit Withdrawn(msg.sender, amount);
}

Although the user's lock data has been deleted, the system still considers the withdrawn tokens as locked sytem-wide, leading to DoS on new activities via lock() and increase() in the event totalLocked == maxTotalLocked.

Additionally, each time _updateBoostState() is invoked, the inflated _lockState.totalLocked will be assigned to _boostState.totalWeight:

veRAACToken.sol#L572

_boostState.totalWeight = _lockState.totalLocked;

This will correspondingly affects the return value of calculateBoost() that has _boostState inputted as the first parameter when invoking BoostCalculator.calculateTimeWeightedBoost().

Impact

The system-wide totalLocked value remains unchanged if it is not explicitly decremented in withdraw(). This prevents any new locks or increases from occurring if totalLocked has already reached maxTotalLocked other than affecting the calculation of the boost multiplier for a user's rewards.

Tools Used

Manual

Recommendations

Consider implementing the following change:

veRAACToken.sol#L320-L322

+ _lockState.totalLocked -= amount;
​
// Clear lock data
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::withdraw / emergencyWithdraw doesn't substract the `_lockState.totalLocked`

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::withdraw / emergencyWithdraw doesn't substract the `_lockState.totalLocked`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!