Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing `_lockState.totalLocked` update in the `withdraw` function of `veRAACToken` may cause a DoS

Coverage

Description

In veRAACToken, users can withdraw their locked RAAC tokens after the lock period ends by calling the withdraw function. However, this function fails to update _lockState.totalLocked, which tracks the total amount of RAAC tokens locked in the system. Since _lockState.totalLocked is never decremented when withdrawals occur, the system will eventually reach _lockState.maxTotalLocked, blocking all future locks or increases and effectively causing a DoS for new or existing users.

Context

Impact

High. Once _lockState.totalLocked reaches _lockState.maxTotalLocked, users will be unable to lock new tokens or increase existing lock positions, disrupting core protocol functionality.

Likelihood

High. Since _lockState.totalLocked is never reduced, it is inevitable that it will eventually reach _lockState.maxTotalLocked, triggering the DoS scenario.

Recommendation

Update the _lockState.totalLocked whenever a user calls the withdraw function.

function withdraw() external nonReentrant {
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert LockNotFound();
if (block.timestamp < userLock.end) revert LockNotExpired();
​
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
​
+ _lockState.totalLocked -= amount;
​
// Clear lock data
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
​
// Update checkpoints
_checkpointState.writeCheckpoint(msg.sender, 0);
​
// Burn veTokens and transfer RAAC
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
emit Withdrawn(msg.sender, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::withdraw / emergencyWithdraw doesn't substract the `_lockState.totalLocked`

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::withdraw / emergencyWithdraw doesn't substract the `_lockState.totalLocked`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.