Submission Details
Severity:
totalSupply() <= MAX_TOTAL_SUPPLY invariant is broken by veRAACToken.increase()
Description
Unlike lock(), increase() doesn't check whether the total supply of veRAACToken exceed the max total supply. Only check implemented by increase() is on individual positions not exceeding maximum allowed for each position but there is no check on the total aggregated positions cap.
// https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L251-L273
function increase(uint256 amount) external nonReentrant whenNotPaused {
// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
...
}
// https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/governance/LockManager.sol#L161-L164
function increaseLock(&args) internal {
...
// Maximum lock amount
if (lock.amount + additionalAmount > state.maxLockAmount) revert AmountExceedsLimit();
// Maximum total locked amount
// if (state.totalLocked + additionalAmount > state.maxTotalLocked) revert AmountExceedsLimit();
...
}
On the other hand, lock() clearly prevent it via this check:
// https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L215
if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
Impact
disruption of governance
potential exploits for vote manupilation
devaluing of veRAACToken
Recommendations
function increase(uint256 amount) external nonReentrant whenNotPaused {
+ if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
...
}
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::increase doesn't check the token supply, making it possible to mint over the MAX
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.