Core Contracts

Summary

The lock and increase functions do not explicitly verify that the total amount of RAAC tokens locked in the system does not exceed the MAX_TOTAL_LOCKED_AMOUNT. They rely on the LockManager library to enforce this, which may not be sufficient.

Vulnerability Details

The bug arises from the lack of an explicit check in the contract functions that handle locking, relying instead on the underlying LockManager without verifying the global limit before processing a new lock or increase.

For example, if MAX_TOTAL_LOCKED_AMOUNT is set to 1B tokens, but there is no check, users could collectively lock 1.2B tokens. This excess locking would allow the total veRAAC supply (and therefore voting power) to exceed protocol limits, potentially diluting governance or reward distributions.

Impact

If the total locked RAAC tokens exceed the defined global cap, it could lead to protocol imbalances and potentially infinite inflation of voting power. This could undermine the integrity of the governance system by allowing too much influence to be derived from locked tokens.

Recommendations

Add explicit checks in the lock and increase functions to ensure that the sum of all locked RAAC tokens plus the new amount does not exceed MAX_TOTAL_LOCKED_AMOUNT. This can be done by tracking a global total and reverting if the new total would exceed the cap.