Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Users can overwrite their lock

yaioxy

Summary

Users can accidentally overwrite their existing locks by calling lock() multiple times, leading to permanent loss of their RAAC tokens as the original lock data is overwritten without proper withdrawal handling.

Vulnerability Details

In veRAACToken.sol::lock() and LockManager.sol::createLock(), there is no check preventing users from creating a new lock when they already have one:

// In veRAACToken.sol
function lock(uint256 amount, uint256 duration) external {
// Transfers user tokens first
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Creates new lock, overwriting any existing one
_lockState.createLock(msg.sender, amount, duration);
}
​
// In LockManager.sol
function createLock(LockState storage state, address user, uint256 amount, uint256 duration) internal {
//....
// Directly overwrites any existing lock
state.locks[user] = Lock({amount: amount, end: end, exists: true});
//...
}

  1. User locks 1000 RAAC for 1 year

  2. After 6 months, user accidentally calls lock() again with 500 RAAC

  3. Original lock containing 1000 RAAC is overwritten

  4. User can only withdraw 500 RAAC after lock expiry

  5. The original 1000 RAAC are permanently stuck in the contract

Impact

  • Users permanently lose access to their originally locked RAAC tokens

  • Protocol accumulates stuck RAAC tokens that can never be withdrawn

  • Voting power calculations may be incorrect

Tools Used

Manual review

Recommendations

Add existence check before creating new locks:

function createLock(LockState storage state, address user, uint256 amount, uint256 duration) internal {
if (state.locks[user].exists) revert ExistingLockFound();
// Continue with lock creation
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::lock called multiple times, by the same user, leads to loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.