Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

no max total supply validation while extending a lock

n1kh11l

Vulnerability Details

Extending Lock Duration Mints Excess veRAAC Tokens Beyond Supply Cap The extend function allows users to increase their lock duration and mint additional veRAAC tokens without validating against the MAX_TOTAL_SUPPLY limit. This bypasses the protocol’s supply cap,

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L280-L305

function extend(uint256 newDuration) external nonReentrant whenNotPaused {
// Extend lock using LockManager
uint256 newUnlockTime = _lockState.extendLock(msg.sender, newDuration);
​
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount,
newUnlockTime
);
​
​
// Update checkpoints
uint256 oldPower = balanceOf(msg.sender);
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
​
// Update veToken balance
if (newPower > oldPower) {
_mint(msg.sender, newPower - oldPower);
} else if (newPower < oldPower) {
_burn(msg.sender, oldPower - newPower);
}
​
​
emit LockExtended(msg.sender, newUnlockTime);
}

Current State:

totalSupply() = 100M veRAAC (cap fully reached).

User’s Existing Lock:

RAAC Locked: 5M (within per-position limit)

Initial Duration: 1 year → Voting Power = (5M * 1) / 4 = 1.25M veRAAC

Attack Steps

  1. User Extends Lock to 3 Years:

    • New Voting Power:


      (5M RAAC * 3 years) / 4 years = 3.75M veRAAC

    • Delta to Mint: 3.75M - 1.25M = 2.5M veRAAC

    • Mints 2.5M veRAAC despite the cap being maxed.

      New Total Supply: 100M + 2.5M = 102.5M veRAAC

Impact

max total supply voilation

root cause

no validation check on maxtotalsupply while extending a lock

Recommendations

  1. Add MAX_TOTAL_SUPPLY Check in extend

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect `MAX_TOTAL_SUPPLY` check in the `veRAACToken::lock/extend` function of `veRAACToken` could harm locking functionality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.