Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incompatibility of veRAACToken as a Staking Token in RAACGauge and RWAGauge Contracts

mill1995

Summary

The RAACGauge and RWAGauge contracts use veRAACToken as their staking token, but veRAACToken is non-transferable by design. This makes it impossible for users to stake their tokens in the gauges since the tokens cannot be transferred to the gauge contracts.

There is no clear documentation which token will be used as staking token but the existing tests use the veRAACToken:
[https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/test/unit/core/governance/gauges/RWAGauge.test.js#L53]
[https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/test/unit/core/governance/gauges/RAACGauge.test.js#L51]

Vulnerability Details

The veRAACToken prevents all transfers and trasnferFrom:

function _update(address from, address to, uint256 amount) internal virtual override {
if (from == address(0) || to == address(0)) {
// Allow minting and burning operations
super._update(from, to, amount);
return;
}
​
// Prevent all other transfers of veRAAC tokens
revert TransferNotAllowed();
}

The Gauges require a stakingToken when deployed:

constructor(
address _rewardToken,
@> address _stakingToken,
address _controller
) BaseGauge(_rewardToken, _stakingToken, _controller, MAX_WEEKLY_EMISSION, WEEK) {}

When you want to stake that token it will revert because of the _update() function:

function stake(uint256 amount) external nonReentrant updateReward(msg.sender) {
if (amount == 0) revert InvalidAmount();
_totalSupply += amount;
_balances[msg.sender] += amount;
// Will revert
@> stakingToken.safeTransferFrom(msg.sender, address(this), amount);
emit Staked(msg.sender, amount);
}

Impact

  • Staking functionality in both gauge contracts is completely broken

Tools Used

  • Manual Review

Recommendations

  • Provide clear documentation about the staking token that will be used

  • If the protocol really wants to use the veRAACToken as staking token this requires more work to make sure this doesn't break any core functions

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.