Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Checkpoint Update in `emergencyWithdraw` Function of `veRAACToken` Contract

bwrauncge

Summary

The emergencyWithdraw function in the veRAACToken contract has an issue related to the missing update of the checkpoint.

Vulnerability Details

Lines:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L367C14-L367C31

function emergencyWithdraw() external nonReentrant {
if (emergencyWithdrawDelay == 0 || block.timestamp < emergencyWithdrawDelay)
revert EmergencyWithdrawNotEnabled();
​
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert NoTokensLocked();
​
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
​
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
​
emit EmergencyWithdrawn(msg.sender, amount);
}

The function deletes the user's lock state and their voting points, but it does not update the checkpoint for the user's voting power. Since checkpoints are crucial for tracking the historical voting power of users at specific points in time. When a user withdraws their tokens, their voting power should be updated to reflect that they no longer hold any locked tokens.

Impact

By not updating the checkpoint, the contract leaves a gap in the historical data. If someone queries the voting power of the user after the emergency withdrawal, they may still see the old voting power, which could lead to confusion and incorrect assumptions about the user's voting rights.

Tools Used

Manual Review

Recommendations

To address this issue, the emergencyWithdraw function should include a call to update the checkpoint after the user has withdrawn their tokens. This can be done by adding a line to write a checkpoint with a voting power of zero:

_checkpointState.writeCheckpoint(msg.sender, 0);
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::emergencyWithdraw doesn't update checkpoint - innacurate historical voting power, inconsistent state

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.