Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: low
Invalid

MAX_TOTAL_LOCKED_AMOUNT Constant Is Mathematically Impossible Due to Supply Constraints

Link to Affected Code:

Docs stated that :

MAX_TOTAL_SUPPLY: 100M tokens
MAX_LOCK_AMOUNT: 10M tokens
MAX_TOTAL_LOCKED_AMOUNT: 1B tokens
uint256 public constant MAX_TOTAL_LOCKED_AMOUNT = 1_000_000_000e18; // 1B

Description:
The contract defines MAX_TOTAL_LOCKED_AMOUNT as 1 billion RAAC tokens, but this amount is mathematically impossible to achieve due to the veRAAC supply constraints. The maximum veRAAC supply is 100M tokens, and even with minimum lock duration (1 year), the maximum possible RAAC that could be locked is 400M tokens.

This occurs because:

  1. veRAAC minting is based on: veRAAC = (RAAC * lockDuration) / MAX_LOCK_DURATION

  2. MAX_TOTAL_SUPPLY of veRAAC is 100M tokens

  3. Minimum lock duration (1 year) gives 0.25x ratio of RAAC:veRAAC

  4. Therefore maximum RAAC possible to lock is 400M (100M/0.25)

This creates a misunderstanding because the initial plan was to have the capacity to lock 1b RAAC tokens but its never possible , because it reverts here if the locks goes above the MAX_TOTAL_SUPPLY

function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
if (amount == 0) revert InvalidAmount();
if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit();
@> if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
if (duration < MIN_LOCK_DURATION || duration > MAX_LOCK_DURATION)

Impact:

  • User's cant lock more RAAC even thought the 1b cap hasnt been reached whileas the DOCs defined that 1b RAAC is possible to Lock

  • Documentation and economic models using this constant are incorrect

Proof of Concept:
Maximum RAAC lockable with 1 year duration (worst case):

MAX_RAAC = MAX_TOTAL_SUPPLY * (MAX_LOCK_DURATION / MIN_LOCK_DURATION)
MAX_RAAC = 100M * (4 years / 1 year)
MAX_RAAC = 400M RAAC

Maximum RAAC lockable with 4 year duration (best case):

MAX_RAAC = MAX_TOTAL_SUPPLY * 1 // 1:1 ratio
MAX_RAAC = 100M RAAC

In both cases, reaching 1B RAAC locked is impossible.

Recommended Mitigation:

  1. Adjust MAX_TOTAL_LOCKED_AMOUNT to reflect actual maximum:

uint256 public constant MAX_TOTAL_LOCKED_AMOUNT = 400_000_000e18; // 400M - maximum possible
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.