Core Contracts

Summary

The veRAACToken contract contains a vulnerability that allows users to bypass the maximum lock amount restriction defined by MAX_LOCK_AMOUNT. While the lock function enforces this limit, the increase function does not check whether the new total locked amount exceeds MAX_LOCK_AMOUNT. This allows users to lock more tokens than intended by first locking a small amount and then repeatedly calling the increase function.

Vulnerability Details

The lock function enforces a maximum lock amount per position via the MAX_LOCK_AMOUNT constant. However, the increase function does not include this check, allowing users to bypass the restriction. This inconsistency in validation creates a loophole where users can exceed the intended maximum lock amount.

1. lock Function:

   function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {

   if (amount == 0) revert InvalidAmount();

   if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit(); // Enforces MAX_LOCK_AMOUNT

   // Rest of the function...

   }

2. increase Function:

   function increase(uint256 amount) external nonReentrant whenNotPaused {

   // Increase lock using LockManager

   _lockState.increaseLock(msg.sender, amount); // No check for MAX_LOCK_AMOUNT

   // Rest of the function...

   }

• The lock function enforces the MAX_LOCK_AMOUNT limit, but the increase function does not.

• A user can lock a small amount (e.g., 1 token) and then repeatedly call increase to bypass the MAX_LOCK_AMOUNT restriction.

Example:

Impact

The bypass undermines the protocol's design, which is intended to limit the maximum amount of tokens a single user can lock.

Tools Used

Manual Review

Recommendations

Ensure the increase function checks that the new total locked amount does not exceed MAX_LOCK_AMOUNT.