Submission Details
Severity:
The `veRAACToken:lock` function do not stores the lock data in the locks mapping.
Description:
The `veRAACToken:lock` function, locks RAAC tokens for a specified duration and mints veRAAC tokens representing voting power. The `LockManager:createLock` stores in `LockManager:locks` mapping, the lock data. But the `veRAACToken` have another `locks` mapping, and the `veRAACToken:lock` do not stores the lock data in this mapping.
The functions `veRAACToken:getLockedBalance` and `veRAACToken:getLockEndTime` return the data from the `veRAACToken:locks` mapping.
Impact:
Since the functions `veRAACToken:getLockedBalance` and `veRAACToken:getLockEndTime` get the data to return from the `veRAACToken:locks` mapping, that is empty, and not from the `LockManager:locks` that is where data is stored, this functions will always return 0.
Proof of Concept:
<details> <summary>Proof Of Code</summary>
**Here are the steps to run the Foundry PoC:**
1. Open the `linux terminal`, `wsl` in windows.
2. `nomicfoundation` installation:
- If you have `npm` installed run this command:
- `npm install --save-dev @nomicfoundation/hardhat-foundry`
- If you have `yarn` installed run this command:
- `yarn add --dev @nomicfoundation/hardhat-foundry`
- If you have `pnpm` installed run this command:
- `pnpm add --save-dev @nomicfoundation/hardhat-foundry`
3. open the `hardhat.config.cjs`
- Paste this at the begining of the code:
- `require("@nomicfoundation/hardhat-foundry");`
4. run `npx hardhat init-foundry`
- This task will create a `foundry.toml` file with the right configuration and install `forge-std`
5. In the `test/` forlder create a new folder called `ProofOfCodes`
6. In this `test/ProofOfCodes` folder create a new file and paste the following code
7. To run the test you should run `forge test --mt test_lockFunctionDontStoresTheLockDataInTheStorageMapping -vvvv`
```solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
import {Test,console2} from "lib/forge-std/src/Test.sol";
import {veRAACToken, IveRAACToken} from "contracts/core/tokens/veRAACToken.sol";
import {RAACToken} from "contracts/core/tokens/RAACToken.sol";
import {ERC20Mock, ERC20} from "contracts/mocks/core/tokens/ERC20Mock.sol";
contract RAACMinterPoC is Test {
RAACToken raacToken;
veRAACToken veRaac;
address user = makeAddr("user");
address initialOwner = makeAddr("initialOwner");
event LockCreated(address indexed user, uint256 amount, uint256 unlockTime);
function setUp() external {
vm.roll(block.number + 100);
vm.warp(block.timestamp + 10 days);
raacToken = new RAACToken(initialOwner, 0, 0);
veRaac = new veRAACToken(address(raacToken));
deal(address(raacToken), user, 10e18);
}
function test_lockFunctionDontStoresTheLockDataInTheStorageMapping() external {
vm.startPrank(user);
raacToken.approve(address(veRaac), 10e18);
vm.expectEmit();
emit LockCreated(user, 10e18, block.timestamp + 1460 days);
veRaac.lock(10e18, 1460 days);
vm.stopPrank();
assertEq(veRaac.getLockedBalance(user), 0);
assertEq(veRaac.getLockEndTime(user), 0);
}
}
```
</details>
Recommended Mitigation:
The functions `veRAACToken:getLockedBalance` and `veRAACToken:getLockEndTime` should get the value from the `LockManager:locks` mapping not from the `veRAACToken:locks`.
```diff
function getLockedBalance(address account) external view returns (uint256) {
- return locks[account].amount;
+ return _lockState.locks[account].amount:
}
function getLockEndTime(address account) external view returns (uint256) {
- return locks[account].end;
+ return _lockState.locks[account].end:
}
```
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::getLockEndTime and getLockedBalance returns 0 by reading from unused locks mapping instead of _lockState, making lock expiry times unavailable to clients
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::getLockEndTime and getLockedBalance returns 0 by reading from unused locks mapping instead of _lockState, making lock expiry times unavailable to clients
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.