Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`getLockedBalance` function retrieves incorrect data in veRAACToken contract

DRUGstore

Summary

The getLockedBalance function in the veRAACToken contract incorrectly references the locks mapping instead of the _lockState.locks mapping, leading to inaccurate balance readings for locked tokens.

Vulnerability Details

The function getLockedBalance is designed to return the amount of RAAC tokens locked by a specific account.

However, it retrieves this data from the locks mapping, which is unused in the contract. The correct data source should be the _lockState.locks mapping, which contains the actual lock state. This discrepancy causes the function to return stale or zero values, even when valid locks exist in _lockState.

/**
* @notice Gets the amount of RAAC tokens locked by an account
* @dev Returns the raw locked token amount without time-weighting
* @param account The address to check
* @return The amount of RAAC tokens locked by the account
*/
function getLockedBalance(address account) external view returns (uint256) {
//@audit - The function is incorrectly referencing the locks mapping when it should be using the _lockState.locks mapping
return locks[account].amount;
}

Impact

This bug can lead to incorrect reporting of locked balances. Users may be unable to verify their locked balances correctly, leading to confusion and potential loss of trust in the protocol.

Tools Used

Manual review

Recommendations

Update the function to reference _lockState.locks instead of locks:

function getLockedBalance(address account) external view returns (uint256) {
return _lockState.locks[account].amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::getLockEndTime and getLockedBalance returns 0 by reading from unused locks mapping instead of _lockState, making lock expiry times unavailable to clients

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::getLockEndTime and getLockedBalance returns 0 by reading from unused locks mapping instead of _lockState, making lock expiry times unavailable to clients

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.