Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

_lockState.totalLocked not updated in withdrawal functions in veRAACToken

josh4324

Summary

The withdraw and emergencyWithdraw functions do not update _lockState.totalLocked when locked tokens are withdrawn.

Vulnerability Details

function withdraw() external nonReentrant {
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert LockNotFound();
if (block.timestamp < userLock.end) revert LockNotExpired();
​
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
​
// Clear lock data
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
​
// Update checkpoints
_checkpointState.writeCheckpoint(msg.sender, 0);
​
// Burn veTokens and transfer RAAC
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
emit Withdrawn(msg.sender, amount);
}

The function deletes the user data, but it does not update the _lockState.totalLocked. This means the totalLocked will remain the same even after users have unlocked or withdrawn their tokens. If the lock function is checking for the MAX_TOTAL_LOCKED_AMOUNT, the check won't be accurate because the _lockState.totalLocked will not return the correct value.

Impact

The contract is not tracking the correct amount of locked tokens.

Tools Used

Manual Review

Recommendations

Modify withdraw and emergencyWithdraw to decrease _lockState.totalLocked when users withdraw their locked tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::withdraw / emergencyWithdraw doesn't substract the `_lockState.totalLocked`

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::withdraw / emergencyWithdraw doesn't substract the `_lockState.totalLocked`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.