Core Contracts

Summary

The lock() function in veRAACToken contract allows users to create new locks without checking for existing ones. When a user creates a new lock while having tokens already locked, the new lock overwrites the previous lock data in _lockState, causing the original locked tokens to become permanently trapped in the contract.

Vulnerability Details

In the lock() function. there is no check of existing locks and the previous lock will get overwritten.

Scenario:

1. User locks 1000 RAAC tokens for 4 years, receives 1000 veTokens

2. User creates another lock of 100 RAAC tokens for 4 years

3. The second lock overwrites the first lock data

4. After lock duration expires, user can only withdraw 100 RAAC tokens

5. The original 1000 RAAC tokens remain permanently locked in the contract

The issue occurs because:

• No validation for existing locks

• createLock overwrites existing lock data

• No mechanism to merge or manage multiple locks

• No way to recover overwritten lock data

Impact

Loss of user's original locked tokens

Tools Used

Manual Review

Recommendations

Add validation to check for existing locks before creating new ones or
Implement a mechanism to merge locks or prevent multiple locks per address