Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

RaacTokens are not bounded to an EoA address. Users can tokenize veRaac tokens to bypass the non-transferability nature of veTokens

alexczm

Summary

By design,the veTokens can't be transferred to prevent liquid markets, which would allow governance manipulation and boost farming.

Protocol doesn't enforce RaacTokens lockers to be EoA addresses. This allow users to lock tokens using a smartContract with tokenisation capabilities, bypassing the intended protocol design.

Vulnerability Details

Users can call veRaacToken::lock to create a new lock position with the desired amount and duration.

function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
if (amount == 0) revert InvalidAmount();
if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit();
if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
if (duration < MIN_LOCK_DURATION || duration > MAX_LOCK_DURATION)
revert InvalidLockDuration();
​
// Do the transfer first - this will revert with ERC20InsufficientBalance if user doesn't have enough tokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Calculate unlock time
uint256 unlockTime = block.timestamp + duration;
// Create lock position
_lockState.createLock(msg.sender, amount, duration);
_updateBoostState(msg.sender, amount);
​
// Calculate initial voting power
(int128 bias, int128 slope) = _votingState.calculateAndUpdatePower(
msg.sender,
amount,
unlockTime
);
​
// Update checkpoints
uint256 newPower = uint256(uint128(bias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
// Mint veTokens
_mint(msg.sender, newPower);
​
emit LockCreated(msg.sender, amount, unlockTime);
}

The amount of RaacToken is transferred, creates the lock and mints the veRaac amount based on input amount and duration.
The msg.sender is not enforced to be an EoA address.
A malicious user can call the lock function from a wrapper ERC20 contract, creating a transferrable version of veRaac token.
The veToken non-transferable design is bypassed.

Impact

Anyone can create a tokenized wrapper of veRaac token. Users can manipulate governance and get involved in boost farming activities.

Tools Used

Recommendations

Ensure that only EoA addresses can call lock, increase and extend functions.
To mitigate the fact multisig wallets (used by a DAO, protocol treasury, etc) can't be used, the protocol can implement a whitelist.

Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!