Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`getLockPosition` function in veRAACToken contract is wrongly implemented, leading to incorrect returned data and front-end integration issues.

tadev

Summary

getLockPosition function in veRAACToken contract is defined as follows:

function getLockPosition(address account) external view override returns (LockPosition memory) {
LockManager.Lock memory userLock = _lockState.getLock(account);
// @audit MEDIUM: power should be `getVotingPower(account)`
return LockPosition({amount: userLock.amount, end: userLock.end, power: balanceOf(account)});
}

with LockPosition struct being:

/**
* @notice Struct to track a user's complete lock position including voting power
* @param amount The amount of RAAC tokens locked
* @param end The unlock timestamp
* @param power The current voting power of the position
*/
struct LockPosition {
uint256 amount;
uint256 end;
uint256 power;
}
​

The problem is that power field of LockPosition struct is set to balanceOf(account)instead of getVotingPower(account, block.timestamp).

Vulnerability Details

The issue is problematic because getLockPosition returns the amount of veRAACToken a user holds, no taking into account the duration of the lock. This is incorrect, as the voting power is retrieved using getVotingPower function.

Impact

The impact of this issue is medium.

Tools Used

Manual review.

Recommendations

Make sure to correctly return the current user lock position with getLockPosition:

function getLockPosition(address account) external view override returns (LockPosition memory) {
LockManager.Lock memory userLock = _lockState.getLock(account);
return LockPosition({amount: userLock.amount, end: userLock.end, power: getVotingPower(account)});
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::getLockPosition incorrectly reports user voting power by returning raw token balance instead of time-decayed value, causing UI/frontend display inconsistencies

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::getLockPosition incorrectly reports user voting power by returning raw token balance instead of time-decayed value, causing UI/frontend display inconsistencies

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.