Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Increase it's not possible after some lock time passed for VERAAC token

ChainDefenders

Summary

In VERAAC::increase, users can add more locked RAAC tokens to their existing position. However, an issue arises when computing calculateAndUpdatePower. After half of the lock period has passed, newPower can become lower than the current power, causing _mint to revert.

Code Excerpt

function increase(uint256 amount) external nonReentrant whenNotPaused {
// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);
​
// Update checkpoints
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
// Transfer additional tokens and mint veTokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_mint(msg.sender, newPower - balanceOf(msg.sender));
​
emit LockIncreased(msg.sender, amount);
}

Vulnerability Details

Scenario

  1. A user locks their tokens at block.timestamp = 0 for a 1-year period (ending at 1 year).

  2. At block.timestamp = 0.5 years + 1, they increase their locked position by 100 tokens.

  3. Initial voting power:
    100 × (1 year / 4 years) = 100 × 0.25 = 25

  4. New voting power calculation (assuming an added 50 tokens instead of 100 for demonstration):
    (100 + 50) × (0.5 year / 4 years) = 150 × 0.125 = 18

  5. Since newPower < balanceOf(msg.sender), _mint(msg.sender, newPower - balanceOf(msg.sender)) reverts.

Root Cause

  • calculateAndUpdatePower does not work correctly.

  • _mint expects an increase in balance, but the calculation results in a lower power.

Impact

Users cannot correctly increase their voting power mid-lock, leading to a broken locking mechanism and reduced flexibility in governance participation.

Tools Used

Manual review

Recommendations

Modify increase or calculateAndUpdatePower to ensure newPower never decreases when increasing the locked amount

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase underflows on newPower - balanceOf(msg.sender)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.