Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Boost State Update in Withdraw Function Affects Reward Distribution

yaioxy

Summary

The withdraw() function in veRAACToken.sol fails to call _updateBoostState() after users withdraw their tokens, leading to incorrect boost calculations for remaining users.

Vulnerability Details

When users withdraw their locked RAAC tokens, the function:

  1. Burns veRAAC tokens

  2. Transfers RAAC tokens back to user

  3. Clears lock data

  4. Updates checkpoints

However, it doesn't update the boost state variables:

  • _boostState.totalVotingPower

  • _boostState.totalWeight

These values are used in calculateTimeWeightedBoost() to determine reward multipliers for remaining users.

Impact

  1. Remaining users receive lower boost multipliers than they should

  2. Reward distribution becomes inaccurate

Tools Used

Manual review

Recommendations

_updateBoostState() call at the end of the withdraw function:

function withdraw() external nonReentrant {
// Existing withdraw logic
_updateBoostState(msg.sender, 0); // Add this line
emit Withdrawn(msg.sender, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
6 months ago
inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.