Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`_boostState` is incorrectly updated when create/update a lock

h2134

Summary

_boostState is incorrectly updated when create/update a lock.

Vulnerability Details

When user creates a lock position, a lock is created and _boostState, and veRAAC tokens are minted to the user.

veRAACToken::lock()

function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
...
// Create lock position
_lockState.createLock(msg.sender, amount, duration);
_updateBoostState(msg.sender, amount);
​
...
​
// Mint veTokens
_mint(msg.sender, newPower);
​
...
}

In _updateBoostState(), _boostState is updated.

veRAACToken::_updateBoostState()

function _updateBoostState(address user, uint256 newAmount) internal {
// Update boost calculator state
_boostState.votingPower = _votingState.calculatePowerAtTimestamp(user, block.timestamp);
_boostState.totalVotingPower = totalSupply();
_boostState.totalWeight = _lockState.totalLocked;
_boostState.updateBoostPeriod();
}

As can be seen, _boostState.votingPower and _boostState.totalVotingPower are the values before veRAAC tokens are minted, but _boostState.totalWeight is already updated in createLock(). This brings inconsistent values being updated in _boostState, as only _boostState.totalWeight is updated to the newest value after user creates a lock.

Impact

_boostState is incorrectly updated. The impact is low though as _boostState as the updated values are only required by getBoostState().

Tools Used

Manual Review

Recommendations

_updateBoostState() should be called after minting.

function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
...
// Create lock position
_lockState.createLock(msg.sender, amount, duration);
- _updateBoostState(msg.sender, amount);
​
...
​
// Mint veTokens
_mint(msg.sender, newPower);
+ _updateBoostState(msg.sender, amount);
​
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::_updateBoostState should be called later inside lock/increase

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!