Core Contracts

Summary

The veRAACToken contract fails to enforce its maximum supply cap during lock extensions, allowing potential inflation of governance tokens beyond protocol limits. The veRAACToken.extend function mints new voting power tokens when increasing lock durations but omits critical validation against the MAX_TOTAL_SUPPLY constant. This oversight enables actors to bypass the supply cap through repeated lock extensions, directly contradicting the TotalSupplyLimitExceeded error defined in the interface.

This vulnerability threatens the protocol's core governance mechanics by allowing artificial inflation of voting power, which controls all key protocol functions including emissions, parameter changes, and fund allocations. The missing check creates a systemic risk where a single malicious actor could theoretically mint unlimited veRAAC tokens, fundamentally breaking the protocol's tokenomics.

Vulnerability Details

The vulnerability exists in the veRAAC token lock extension mechanism where new voting power tokens are minted without proper supply cap validation. The affected code occurs in function veRAACToken.extend (veRAACToken.sol#L299):

This implementation flaw violates the protocol's tokenomics by potentially allowing unlimited veRAAC token minting through repeated lock extensions, which could dilute voting power distributions and destabilize governance mechanisms. The vulnerability is particularly critical given that veRAAC tokens directly control protocol governance and reward distributions.

Impact

The absence of supply cap validation in lock extensions creates three critical risks to protocol integrity:

1. Tokenomics Breakdown
   Unchecked minting could permanently exceed the MAX_TOTAL_SUPPLY, rendering the protocol's deflationary mechanisms and voting power calculations ineffective

2. Governance Capture
   Malicious actors could strategically extend locks to mint excess voting tokens, enabling:

   • Proposal manipulation

   • Gauge weight control

   • Protocol parameter changes

3. Economic Spiral
   Excessive supply would:

   • Dilute existing holders' voting power

   • Distort RAAC emission schedules

   • Potentially collapse the ve-token value proposition

This vulnerability fundamentally undermines the protocol's governance security model, as veRAAC tokens directly control:

• Emission directions (via gauges)

• Protocol parameter upgrades

• Treasury fund allocations

Tools Used

Manual Review

Recommendations

Add explicit checks against MAX_TOTAL_SUPPLY in veRAACToken.extend: