Summary
The lock function in the veRAACToken contract contains a critical vulnerability that allows users to overwrite their existing locks, leading to a loss of previously locked tokens. The contract doesn't check if the user has already locked tokens before updating their locks
Vulnerability Details
The lock function in veRAACToken.sol allows users to create new lock positions for RAAC tokens. However, the current implementation overwrites existing locks without properly handling the previous locked amount.
veRAACToken.sol
* @notice Creates a new lock position for RAAC tokens
* @dev Locks RAAC tokens for a specified duration and mints veRAAC tokens representing voting power
* @param amount The amount of RAAC tokens to lock
* @param duration The duration to lock tokens for, in seconds
*/
function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
if (amount == 0) revert InvalidAmount();
if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit();
if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
if (duration < MIN_LOCK_DURATION || duration > MAX_LOCK_DURATION)
revert InvalidLockDuration();
raacToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 unlockTime = block.timestamp + duration;
_lockState.createLock(msg.sender, amount, duration);
_updateBoostState(msg.sender, amount);
(int128 bias, int128 slope) = _votingState.calculateAndUpdatePower(
msg.sender,
amount,
unlockTime
);
uint256 newPower = uint256(uint128(bias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
_mint(msg.sender, newPower);
emit LockCreated(msg.sender, amount, unlockTime);
}
LockManager.sol:
* @notice Creates a new lock position
* @dev Validates duration and amount, creates lock entry
* @param state The lock state storage
* @param user Address creating the lock
* @param amount Amount of tokens to lock
* @param duration Duration of the lock in seconds
* @return end The timestamp when the lock expires
*/
function createLock(
LockState storage state,
address user,
uint256 amount,
uint256 duration
) internal returns (uint256 end) {
if (state.minLockDuration != 0 && state.maxLockDuration != 0) {
if (duration < state.minLockDuration || duration > state.maxLockDuration)
revert InvalidLockDuration();
}
if (amount == 0) revert InvalidLockAmount();
end = block.timestamp + duration;
state.locks[user] = Lock({
amount: amount,
end: end,
exists: true
});
state.totalLocked += amount;
emit LockCreated(user, amount, end);
return end;
}
Impact
Tools Used
Manual review
Recommendations
Check if msg.sender has initial locks before create/overriding their locks.
