Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Checkpoint Updates in Emergency Withdrawals Lead to Incorrect Voting Power

allamloqman

Summary :

The emergencyWithdraw function in veRAACToken fails to update checkpoints when users withdraw tokens in emergency scenarios, leading to incorrect voting power calculations and potential governance manipulation.

Vulnerability Details :

the issue exist in :

function emergencyWithdraw() external nonReentrant {
if (emergencyWithdrawDelay == 0 || block.timestamp < emergencyWithdrawDelay)
revert EmergencyWithdrawNotEnabled();
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert NoTokensLocked();
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
// Missing checkpoint update:
// _checkpointState.writeCheckpoint(msg.sender, 0);
}

The checkpoint's role is crucial as we know that Checkpoints track historical voting power for governance

function getVotingPowerForProposal(address account, uint256 proposalId) external view returns (uint256) {
uint256 snapshotBlock = proposalPowerSnapshots[proposalId];
if (snapshotBlock == 0) revert InvalidProposal();
return getPastVotes(account, snapshotBlock);
}

the Proposals need accurate historical voting power while the Governance decisions rely on checkpoint data ( Checkpoints provide voting power at specific blocks)

function getPastVotes(address account, uint256 blockNumber) public view returns (uint256) {
return _checkpointState.getPastVotes(account, blockNumber);
}

Impact :

This can lead to Incorrect historical voting power records and could make the Protocol governance integrity at risk.

Tools Used :

Manuel Review.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::emergencyWithdraw doesn't update checkpoint - innacurate historical voting power, inconsistent state

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!