Core Contracts

Summary :

The increase(0) function call allows users to maintain constant voting power by creating new checkpoints that bypass the intended linear decay of voting power over time.

Vulnerability Details :

The vulnerability exist in the increase function in the veRAACToken contract that doesn't check for Zero amount as follow :

Each checkpoint stores:

Block number when created and Compressed power value at that block, so can The voting power queries use these checkpoints:

we can show this with a simple attack path :

1. User has existing lock with voting power.

2. Calls increase(0) multiple times.

3. Each call creates new checkpoint at current block.

4. Same voting power recorded at different blocks.

as we can see in the writeCheckpoint function in Checkpoints contract :

This shows that:

1. When in same block, it applies an operation (op) between last value and new value

2. When in new block, it directly compresses and stores the new value therefor the vote Power value doesn't decay as intended and Continues until lock expiry.

Impact :

[the likelihood is high so does the impact.]

The voting power influence got extended with the same initial power effectively maintaining the exact same initial power sustained until the lock period ends.

Recommendations :

Implement a strict amount validation.