Core Contracts

Summary

The function veRAACToken::lock does not check whether the user already has an existing locked position or if they are locking tokens for the first time. This omission causes previously locked values to be overwritten, leading to loss of voting power and locked funds data.

Vulnerability Details

The function veRAACToken::lock is responsible for locking RAAC tokens in exchange for veRAACTokens, which serve as voting power in governance. However, the function lacks a check to determine if the user already has an active lock. As a result, when a user attempts to lock additional funds, their previous position is overwritten instead of being updated, leading to loss of accumulated voting power and incorrect lock state tracking.

Key Affected Areas:

1. Lock State Overwritten
   In _lockState::createLock, a new lock replaces the existing one without checking if the user already has a locked position:

   state.locks[user] = Lock({

   amount: amount,

   end: end,

   exists: true

   });

   • Impact: If a user locks additional tokens, their previous lock amount and duration are replaced, effectively resetting their lock progress.

2. Voting Power Reset
   In _votingState::calculateAndUpdatePower, the previous voting power is discarded, and a new state is assigned:

   state.points[user] = RAACVoting.Point({

   bias: bias,

   slope: slope,

   timestamp: block.timestamp

   });

   • Impact: The user's voting power is recomputed from scratch, erasing previously accumulated voting influence.

Impact

• Users lose their previous locked tokens' progress when attempting to lock additional funds.

• Voting power resets, leading to governance inconsistencies.

• Potential manipulation by malicious users who intentionally reset their lock state to gain an unfair advantage.

Tools Used

• Manual review

• Static analysis

Recommendations

• Check if the user already has a locked position before overwriting values.

• Modify the logic to allow additional deposits to extend an existing lock instead of replacing it.

• Implement a merge/update mechanism for existing locks instead of replacing them entirely.