Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Bypass of MAX_TOTAL_LOCKED_AMOUNT via veRAACToken:: function increase

DRUGstore

Summary

The increase function allows bypassing the MAX_TOTAL_LOCKED_AMOUNT limit by adding tokens to existing locks after initial creation, enabling the protocol to exceed its intended maximum locked value. Which in turn lets users to dilute voting rights and get unfair boosts.

Vulnerability Details

The protocol enforces MAX_TOTAL_LOCKED_AMOUNT during initial lock creation but fails to validate it when increasing existing locks, allowing:

  1. Initial lock creation under the limit

  2. Subsequent increases that push total locked over MAX_TOTAL_LOCKED_AMOUNT

function increase(uint256 amount) external nonReentrant whenNotPaused {
// Increase lock using LockManager //@audit - attacker can bypass the MAX_TOTAL_LOCKED_AMOUNT by calling this function after the lock is created and some time has passed.
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState
.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);
// ... rest of function ...
}

The vulnerability arises because:

  • MAX_TOTAL_LOCKED_AMOUNT check exists in lock()

  • No equivalent check in increase()

Impact

Because the MAX_TOTAL_LOCKED_AMOUNT is breached through the increase function, this leads to dilution in the governance voting rights for the people that actually deposited before the limit is beached. This also ends up distorting the boost mechanism, where the users who increase their locks are unfairly rewarded with boosts in spite of having reached the MAX_TOTAL_LOCKED_AMOUNT.

Tools Used

Manual review

Recommendations

// In veRAACToken.sol's increase function:
function increase(uint256 amount) external nonReentrant whenNotPaused {
// Add total supply check
if (totalSupply() + amount > MAX_TOTAL_SUPPLY)
revert TotalSupplyLimitExceeded();
_lockState.increaseLock(msg.sender, amount);
// ... rest of function ...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doesn't check the token supply, making it possible to mint over the MAX

veRAACToken::increase doesn't check the maximum total locked amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.