Submission Details
Severity:
Incorrect Lock Data Access Due to Uninitialized Mapping in veRAACToken View Functions
Description
The veRAACToken::getLockedBalance and veRAACToken::getLockEndTime functions access the uninitialized locks mapping instead of _lockState.locks, causing them to always return zero values.
function getLockedBalance(address account) external view returns (uint256) {
@> return locks[account].amount; // Always returns 0
}
function getLockEndTime(address account) external view returns (uint256) {
@> return locks[account].end; // Always returns 0
}
Risk
Likelihood: Medium
Affects all calls to these view functions
External integrations likely use these functions
Impact: Low
Returns incorrect data about user positions
May affect UI displays and external integrations
Recommended Mitigation
function getLockedBalance(address account) external view returns (uint256) {
- return locks[account].amount;
+ return _lockState.locks[account].amount;
}
function getLockEndTime(address account) external view returns (uint256) {
- return locks[account].end;
+ return _lockState.locks[account].end;
}
The fix updates view functions to read from the correct storage
Updates
Lead Judging Commences
inallhonesty 2 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::getLockEndTime and getLockedBalance returns 0 by reading from unused locks mapping instead of _lockState, making lock expiry times unavailable to clients
inallhonesty 2 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::getLockEndTime and getLockedBalance returns 0 by reading from unused locks mapping instead of _lockState, making lock expiry times unavailable to clients
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.