Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Double-counting of lock amount in veRAACToken's `increase` function

incogknito

Summary

The increase function in the veRAACToken.sol contains a bug where the lock amount is counted twice when calculating voting power, leading to inflated voting power for users who increase their lock amounts.

Vulnerability Details

Looking at the increase function, we can see that the amount is double-counted during voting power calculation:

function increase(uint256 amount) external nonReentrant whenNotPaused {
// First addition of amount
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Load the already increased lock
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
// Second addition of amount (double-counting)
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount, // Bug: amount is added again
userLock.end
);
// Rest of the function...
}

_lockState.increaseLock(msg.sender, amount) adds the amount to the user's lock. userLock = _lockState.locks[msg.sender] loads the lock that already includes the new amount and calculateAndUpdatePower is called with userLock.amount + amount, effectively adding the amount twice

Impact

Inflated voting power for users who increase their lock amounts. Also, lead to incorrect governance voting weight calculations thereby providing unfair boost multipliers in the protocol.

Tools Used

  • Manual code review

Recommendations

Fix the double-counting by removing the second addition of amount:

function increase(uint256 amount) external nonReentrant whenNotPaused {
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount, // Fixed: removed + amount since userLock.amount already includes it
userLock.end
);
​
// Rest of the function...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doubles the voting power of users

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.