Core Contracts

Description

In veRAACToken there is a maximum global limit (MAX_TOTAL_LOCKED_AMOUNT) on the total amount of RAAC tokens that can be locked. However, this restriction is not enforced in the lock function, allowing users to bypass this restriction and lock more tokens than intended.

Context

• veRAACToken.sol#L212-L244

• veRAACToken.md#L75

Impact

High. The absence of this restriction check allows users to exceed the maximum locked token limit, potentially breaking protocol assumptions and leading to unintended consequences.

Likelihood

High. Since the lock function does not validate the global locked token limit, any user can bypass this restriction.

Recommendation

Implement a check inside the lock function to enforce the MAX_TOTAL_LOCKED_AMOUNT restriction, preventing users from locking more tokens than the allowed limit.