Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect lock expiry data retrieved in `veRAACToken::getLockEndTime` function

DRUGstore

Summary

The getLockEndTime function in the veRAACToken contract is flawed as it retrieves lock expiration data from the wrong storage location, resulting in incorrect lock end times being returned.

Vulnerability Details

The getLockEndTime function is intended to return the timestamp when a user's lock expires.

/**
* @notice Gets the lock end time for an account
* @dev Returns the timestamp when the lock expires
* @param account The address to check
* @return The unix timestamp when the lock expires
*/
function getLockEndTime(address account) external view returns (uint256) {
//@audit - The function retrieves wrong data, it should be using the _lockState.locks mapping
return locks[account].end;
}

However, it incorrectly queries the locks mapping, which is not actively used in the contract. The correct data source is the _lockState.locks mapping, which holds the actual lock state. This error causes the function to return outdated or zero values, even when valid locks exist in _lockState.

Impact

This issue can mislead users about their lock expiration times, potentially causing them to miss opportunities to extend or withdraw their locks. It could also disrupt governance processes, as users may base their decisions on incorrect lock duration information.

Tools Used

Manual review

Recommendations

Modify the function to use _lockState.locks instead of locks:

function getLockEndTime(address account) external view returns (uint256) {
return _lockState.locks[account].end;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::getLockEndTime and getLockedBalance returns 0 by reading from unused locks mapping instead of _lockState, making lock expiry times unavailable to clients

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::getLockEndTime and getLockedBalance returns 0 by reading from unused locks mapping instead of _lockState, making lock expiry times unavailable to clients

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.