Core Contracts

Summary

Inside VerRAACToken contract ,The variable emergencyUnlockEnabled is set to true in the executeEmergencyUnlock function but is never used anywhere in the contract’s logic. This means that even if emergency unlock is enabled, the rest of the contract does not check this flag to allow users to withdraw their tokens under emergency conditions.

Vulnerability Details

The root cause is incomplete implementation: the emergency unlock functionality is signaled by setting emergencyUnlockEnabled, but no functions reference this flag to modify behavior accordingly.

For instance, if a severe bug occurs and the admin calls executeEmergencyUnlock, users expecting to be able to withdraw locked tokens during the emergency will still be prevented from doing so because the withdrawal logic does not check emergencyUnlockEnabled. This can leave locked funds inaccessible during a crisis.

Impact

Enabling emergency unlock has no operational effect. Users expecting to be able to withdraw their tokens in an emergency will find that the flag is ignored, which may lead to lock-ups and user frustration during critical events.

Recommendations

Integrate checks for emergencyUnlockEnabled into the withdrawal functions (or create dedicated emergency withdrawal functions) so that when the flag is true, users can bypass normal lock expiry requirements. Alternatively, remove the unused variable if emergency unlock functionality is not intended.