Core Contracts

Overview

The contract declares:

The _lockState is a LockManager.LockState, presumably storing a global count of the total RAAC locked. However, in the veRAACToken code snippet provided:

• lock(...) checks MAX_TOTAL_SUPPLY for minted veRAAC, but does not check MAX_TOTAL_LOCKED_AMOUNT.

• increase(...) likewise lacks any check for the global 1B lock limit, though it checks neither local nor library state for the aggregated locked amount.

If the LockManager library does not internally enforce this total locked limit, then there is no code preventing the sum of all user locks from surpassing 1_000_000_000e18. The presence of maxTotalLocked = MAX_TOTAL_LOCKED_AMOUNT in _initializeLockParameters() strongly implies it should be enforced somewhere, but no reference to an actual revert or check is present in the snippet.

Attack/Exploit Path

1. Multiple Users Lock RAAC
   Each user calls lock(...) with large amounts. The code checks only their individual maximum (MAX_LOCK_AMOUNT) and the minted token cap (MAX_TOTAL_SUPPLY), not the global sum.

2. Exceeding 1B
   Over time, as more users lock tokens, the total locked RAAC can exceed 1B if no underlying LockManager function reverts. Because the snippet shows no if (totalLocked + amount > MAX_TOTAL_LOCKED_AMOUNT) revert, the contract can keep accepting locks.

3. Ignoring the maxTotalLocked
   The _lockState.maxTotalLocked field presumably is never validated, letting the global locked balance surpass the stated 1B RAAC limit.

Impact

• Potentially Infinite Lock Growth: The protocol’s assumption of a 1B max locked RAAC can be violated, which may disrupt the economic or governance design (e.g., liquidity constraints, reward distributions, or risk profiles).

• False Security: Other parts of the system or external integrators that rely on a “hard 1B limit” could miscalculate or fail if they assume it can’t be exceeded.

Recommended Fix

• Check Before Every Lock
  In lock(...) and increase(...), call something like:

  if (_lockState.totalLocked + amount > MAX_TOTAL_LOCKED_AMOUNT) {

  revert ExceedsGlobalLockedLimit();

  }

  ​

  or ensure the LockManager library enforces this in createLock/increaseLock. The contract snippet must demonstrate that such a revert path actually exists, or the limit is meaningless.

• Remove or Document
  If a 1B global limit is no longer intended, remove MAX_TOTAL_LOCKED_AMOUNT. Otherwise, ensure it is enforced at the library level or in the local code.