Core Contracts

Summary

The increase function in the veRAACToken contract allows users to increase their locked amount and mint additional veTokens. However, it fails to validate whether the total supply of veTokens will exceed the protocol's maximum supply limit (MAX_TOTAL_SUPPLY). This oversight will lead to the minting of tokens beyond the intended supply cap, violating the protocol's economic model.

Vulnerability Details

The vulnerability is located in the increase function:

link

Root Cause

• The function calculates the new voting power (newPower) based on the increased locked amount and mints the difference between newPower and the user's current balance.

• However, it does not check whether the total supply of veTokens (totalSupply() + (newPower - balanceOf(msg.sender))) will exceed MAX_TOTAL_SUPPLY.

• This allows users to mint tokens beyond the protocol's supply cap.

Impact

1. Supply Cap Violation:

   • The protocol's maximum supply limit (MAX_TOTAL_SUPPLY) could be breached, undermining its tokenomics and design.

Tools Used

Manual Code Review

Recommendations

• Add Maximum Supply Validation
  Before minting new veTokens, add a check to ensure that the total supply will not exceed MAX_TOTAL_SUPPLY: