Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Boost Calculation Due to Outdated TotalSupply in veRAACToken::increase Function

Dowsers

Description

The veRAACToken::increase function updates boost state before minting new tokens. The veRAACToken::_updateBoostState function uses totalSupply for boost calculations, but this value hasn't been updated yet by the subsequent _mint call, leading to incorrect boost ratios.

function increase(uint256 amount) external nonReentrant whenNotPaused {
_lockState.increaseLock(msg.sender, amount);
@> _updateBoostState(msg.sender, _lockState.locks[msg.sender].amount); // Uses outdated totalSupply
// ... calculate new power ...
raacToken.safeTransferFrom(msg.sender, address(this), amount);
@> _mint(msg.sender, newPower - balanceOf(msg.sender)); // Updates totalSupply after boost calculation
}
​
function _updateBoostState(address user, uint256 newAmount) internal {
@> _boostState.totalVotingPower = totalSupply(); // Gets outdated value
_boostState.totalWeight = _lockState.totalLocked;
_boostState.updateBoostPeriod();
}

Example of incorrect calculation:

Initial state:
totalSupply = 1000 veRAACToken
User has 1000 RAAC locked
​
User calls increase(500):
Current boost calculation:
boost = votingPower / totalVotingPower
= 1500 / 1000 // Uses outdated totalSupply
= 1.5 // Incorrect ratio
​
Expected calculation:
boost = votingPower / totalVotingPower
= 1500 / 2500 // Should use updated totalSupply
= 0.6 // Correct ratio

Risk

Likelihood: High

  • Occurs on every increase operation

  • Affects all users increasing their locks

Impact: Medium

  • Boosts are calculated with incorrect ratios

  • Users receive higher boost values than intended

  • Protocol's reward distribution becomes unbalanced

Recommended Mitigation

function increase(uint256 amount) external nonReentrant whenNotPaused {
_lockState.increaseLock(msg.sender, amount);
- _updateBoostState(msg.sender, _lockState.locks[msg.sender].amount);
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);
​
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_mint(msg.sender, newPower - balanceOf(msg.sender));
+ _updateBoostState(msg.sender, _lockState.locks[msg.sender].amount);
​
emit LockIncreased(msg.sender, amount);
}

This ensures boost calculations use the correct, updated totalSupply value, leading to accurate boost ratios.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase uses locks[msg.sender] instead of _lockState.locks[msg.sender] inside _updateBoostState call

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.