Submission Details
Severity:
_lockState.totalLocked has not been lowered on various of places in veRAACToken.sol
Summary
_lockState.totalLocked has not being decreased when calling withdraw() or emergencyWithdraw().
Vulnerability Details
When the totalLocked doesn't get decreased upon withdraw and emergencyWithdraw, it will mess up the calculations of calculateBoost() and getCurrentBoost() functions, which will further return false data.
Impact
Users will receive inflated boost when calling calculateBoost() and getCurrentBoost() as output data.
Which will return unrealistic information.
Tools Used
Manual
Recommendations
Decrease the totalLocked when calling withdraw and emergencyWithdraw
function withdraw() external nonReentrant {
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert LockNotFound();
if (block.timestamp < userLock.end) revert LockNotExpired();
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
// Clear lock data
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
+ _lockState.totalLocked -= amount
...
function emergencyWithdraw() external nonReentrant {
if (emergencyWithdrawDelay == 0 || block.timestamp < emergencyWithdrawDelay)
revert EmergencyWithdrawNotEnabled();
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert NoTokensLocked();
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
+ _lockState.totalLocked -= amount;
...
}
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::withdraw / emergencyWithdraw doesn't substract the `_lockState.totalLocked`
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::withdraw / emergencyWithdraw doesn't substract the `_lockState.totalLocked`
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.