Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Critical over-minting vulnerability in `veRAACToken` contract

nikikiki

Summary

The veRAACToken contract contains a critical vulnerability in the increase function, where there is no validation to enforce the MAX_TOTAL_SUPPLY limit of 100 million tokens. This flaw allows for over-minting.

Vulnerability Details

The increase function is intended to allow users to increase their token balance. However, the function does not verify whether the new total supply remains within the MAX_TOTAL_SUPPLY limit. This neglect allows the contract to exceed the intended cap, as demonstrated in the following scenario:

  1. Initial locks:

    • 10M × 9 users = 90M

    • 8M × 1 user = 8M

    • Total = 98M (less than MAX_TOTAL_SUPPLY)

  2. New lock:

    • +1M from a new user

    • Total = 99M (still valid)

  3. Increase:

    • A user calls increase with +9M tokens

    • New Total = 108M (exceeding MAX_TOTAL_SUPPLY)

Since there is no restriction in place, the contract fails to prevent this excessive minting, allowing the creation of more tokens than the intended supply limit.

Impact

This vulnerability enables token supply inflation beyond intended limits, potentially devaluing existing tokens and destabilizing the market. Malicious actors could exploit this to manipulate token distribution, eroding investor trust and threatening the project's economic integrity by breaking fundamental assumptions of token scarcity.

Recommendations

Add a total supply check in the increase function:

function increase(uint256 amount) external nonReentrant whenNotPaused {
+ if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
​
// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);
​
// Update checkpoints
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
// Transfer additional tokens and mint veTokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_mint(msg.sender, newPower - balanceOf(msg.sender));
​
emit LockIncreased(msg.sender, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doesn't check the token supply, making it possible to mint over the MAX

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.