Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Checkpoint Update in emergencyWithdraw Function

oxelmiguel

Summary

The emergencyWithdraw function in the veRAACToken contract is missing checkpoint update when clearing a user's lock and voting power. This omission could lead to inconsistencies in the protocol's state.

Vulnerability Details

  • The emergencyWithdraw function clears the user's lock and voting power data but fails to update the checkpoints to reflect the removal of the user's voting power.

  • In contrast, the withdraw function correctly updates the checkpoints:

    _checkpointState.writeCheckpoint(msg.sender, 0);

  • This inconsistency means that the checkpoint system may still reflect the user's voting power even after an emergency withdrawal.

Impact

  1. Inconsistent State:

    • The checkpoint system may retain outdated voting power data, leading to incorrect calculations in functions that rely on checkpoints.

Tools Used

Manual Code Review

Recommendations

  • Add Missing Checkpoint Update
    Update the emergencyWithdraw function to include the missing checkpoint update:

function emergencyWithdraw() external nonReentrant {
if (emergencyWithdrawDelay == 0 || block.timestamp < emergencyWithdrawDelay)
revert EmergencyWithdrawNotEnabled();
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert NoTokensLocked();
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
// Clear lock data
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
// Update checkpoints
_checkpointState.writeCheckpoint(msg.sender, 0); // <-- Add this line
// Burn veTokens and transfer RAAC
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
emit EmergencyWithdrawn(msg.sender, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::emergencyWithdraw doesn't update checkpoint - innacurate historical voting power, inconsistent state

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!