Core Contracts

Summary

veRAAC's lock may be blocked

Vulnerability Details

When users lock RAAC in the veRAAC contract, we will trigger _boostState.updateBoostPeriod(). In function updateBoostPeriod(), we will create one 7-days duration period when we lock RAAC at the first time. In the next 7 days, we will update the total duration in function updateValue().

When we create this period, the period's totalDuration is 7 days. When we lock again in the next 7 days, we will add the delta time into the total duration. So the period's total duration will be larger than 7 days.

When current timestamp is larger than periodStart + state.boostWindow, we expect to start one new period. But the problem is that there is one check in createPeriod(): startTime < self.startTime + self.totalDuration. This check will fail, because current total Duration is larger than 7 days. This will cause that veRAAC's lock will be reverted.

For example:

1. Alice locks some RAAC in timestamp X. We create one period, period.startTime = X, period.totalDuration = 7 days.

2. Bob locks some RAAC in timestamp X + 7 days - 2, we will update value, the period.totalDuration will increase to around 14 days.

3. Cathy wants to lock some RAAC in timestamp X + 7 days + 2, we need to create one new period, but timestamp X + 7 days + 2 < timestamp X + 14 days. Cathy's lock will be reverted.

Impact

veRAAC's lock will not work for 7 days.

Tools Used

Manual

Recommendations