Submission Details
Severity:
Hardcoded Constants for Limits
Summary
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/tokens/veRAACToken
Vulnerability Details
The contract contains several harcoded constants, such as:
MAX_TOTAL_SUPPLY = 100_000_000e18;
MAX_LOCK_AMOUNT = 10_000_000e18;
MAX_TOTAL_LOCKED_AMOUNT = 1_000_000_000e18;
Impact
Limits cannot be modified wihtout redeploying the contract.
Reduces flexibility for future contracts upgrades.
Tools Used
Manual Review
Recommendations
Consider using modifiable variables with an onlyOwner setter function:
uint256 public maxTotalSupply;
function setMaxTotalSupply(uint256 newLimit) external onlyOwner {
maxTotalSupply = newLimit;
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.