Core Contracts

Summary

The lock() function in veRAACToken.sol incorrectly assumes a 1:1 relationship between locked RAAC tokens (_lockState.totalLocked) and veTokens (totalSupply()). This could block RAAC locking too early when totalSupply() is nearing MAX_TOTAL_SUPPLY.

Vulnerability Details

The current condition:

veRAACToken.sol#L568

🚨 Incorrectly assumes that:

• Locking 1 RAAC always mints 1 veToken ❌

• Total veTokens (totalSupply()) are equal to _lockState.totalLocked ❌

As a matter of fact, veTokens are minted using this formula:

VotingPowerLib.sol#L89-L92

• Since duration / MAX_LOCK_DURATION is between 1/4 and 1, because of the following constraint where MIN_LOCK_DURATION = 365 days (1 year) and MAX_LOCK_DURATION = 1460 days (4 years):

veRAACToken.sol#L216-L217

• totalSupply() is 0.25× to 1× _lockState.totalLocked

Impact

Users cannot lock RAAC even when veToken supply after calling lock() is below MAX_TOTAL_SUPPLY, reducing participation. Hence, less veTokens than expected could be minted, never reaching MAX_TOTAL_SUPPLY.

Tools Used

Manual

Recommendations

Modify the condition in lock() to ensure it correctly accounts for veToken generation based on duration:

veRAACToken.sol#L568