Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Boost Calculation Due to Outdated TotalSupply in veRAACToken::increase Function

Dowsers

Description

The veRAACToken::increase function updates boost state before minting new tokens. The veRAACToken::_updateBoostState function uses totalSupply for boost calculations, but this value hasn't been updated yet by the subsequent _mint call, leading to incorrect boost ratios.

function increase(uint256 amount) external nonReentrant whenNotPaused {
_lockState.increaseLock(msg.sender, amount);
@> _updateBoostState(msg.sender, _lockState.locks[msg.sender].amount); // Uses outdated totalSupply
// ... calculate new power ...
raacToken.safeTransferFrom(msg.sender, address(this), amount);
@> _mint(msg.sender, newPower - balanceOf(msg.sender)); // Updates totalSupply after boost calculation
}
​
function _updateBoostState(address user, uint256 newAmount) internal {
@> _boostState.totalVotingPower = totalSupply(); // Gets outdated value
_boostState.totalWeight = _lockState.totalLocked;
_boostState.updateBoostPeriod();
}

Example of incorrect calculation:

Initial state:
totalSupply = 1000 veRAACToken
User has 1000 RAAC locked
​
User calls increase(500):
Current boost calculation:
boost = votingPower / totalVotingPower
= 1500 / 1000 // Uses outdated totalSupply
= 1.5 // Incorrect ratio
​
Expected calculation:
boost = votingPower / totalVotingPower
= 1500 / 2500 // Should use updated totalSupply
= 0.6 // Correct ratio

Risk

Likelihood: High

  • Occurs on every increase operation

  • Affects all users increasing their locks

Impact: Medium

  • Boosts are calculated with incorrect ratios

  • Users receive higher boost values than intended

  • Protocol's reward distribution becomes unbalanced

Recommended Mitigation

function increase(uint256 amount) external nonReentrant whenNotPaused {
_lockState.increaseLock(msg.sender, amount);
- _updateBoostState(msg.sender, _lockState.locks[msg.sender].amount);
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);
​
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_mint(msg.sender, newPower - balanceOf(msg.sender));
+ _updateBoostState(msg.sender, _lockState.locks[msg.sender].amount);
​
emit LockIncreased(msg.sender, amount);
}

This ensures boost calculations use the correct, updated totalSupply value, leading to accurate boost ratios.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase uses locks[msg.sender] instead of _lockState.locks[msg.sender] inside _updateBoostState call

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!