Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Low issues - DenTonylifer

dentonylifer

[L-1] Lack of access control in recordVote()

Link

Lack of access control in recordVote() function. Any user can modify _hasVotedOnProposal[] state variable on behalf of any voter and emit fake vote events.
Frontend or other off-chain services may display incorrect events, potentially misleading users.

function recordVote(
address voter,
uint256 proposalId
) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}

Recommended to delete this unused function, because castVote in Governance.sol already tracks votes and emit events.

[L-2] Max total supply is incorrectly checked

Link

Protocol restricts total supply of veRAACToken to be <= 100_000_000e18. But max total supply is incorrectly checked during lock creation. The check uses deposited amount of RAAC tokens instead of newPower - real amount of minted veRAACToken.

* @param amount The amount of RAAC tokens to lock
//...
if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();

These 2 amounts will always be different, because amount of veRAACToken to mint calculated based on deposited amount and duration:

uint256 initialPower = (amount * duration) / MAX_LOCK_DURATION;

Thus if duration < MAX_LOCK_DURATION, then amount of veRAACToken to mint will always be smaller then RAAC amount. Lock creation might revert in some cases, however it shouldn't.

Recommended to check MAX_TOTAL_SUPPLY limit right before minting using newPower value.

[L-3] Max total supply is not checked during lock increasing or extending

Link

Protocol restricts total supply of veRAACToken to be <= 100_000_000e18. Max total supply is checked during lock creation, but not during lock increasing or extending, when new tokens also minted. MAX_TOTAL_SUPPLY limit can be exceeded in some cases - when limit is reached, users can't create new locks, but they can modify existing locks and mint excessive veTokens.

_mint(msg.sender, newPower - balanceOf(msg.sender));

Recommended to check MAX_TOTAL_SUPPLY limit in increase() and extend() functions.

[L-4] Incorrect event emitted in mintRewards function

Link

Incorrect event emitted in mintRewards function - it emits RAAC amount transfered to user instead of RAAC amount minted. These 2 amounts will be different in most cases.

function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {
if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();
uint256 toMint = excessTokens >= amount ? 0 : amount - excessTokens;
excessTokens = excessTokens >= amount ? excessTokens - amount : 0;
​
if (toMint > 0) {
raacToken.mint(address(this), toMint);
}
raacToken.safeTransfer(to, amount);
emit RAACMinted(amount);
}

For comparison, the same event emits corrects values in tick() function:

raacToken.mint(address(stabilityPool), amountToMint);
emit RAACMinted(amountToMint);

Recommended to use toMint value instead.

[L-5] Lack of access control in checkAuctionEnded

Link

Lack of access control in checkAuctionEnded. Any user can call checkAuctionEnded() function and emit fake events, even if auction was already ended and AuctionEnded was emited. Frontend or other off-chain services may display fake events, potentially misleading users.

function checkAuctionEnded() external {
require(block.timestamp >= state.endTime, "Auction not ended");
emit AuctionEnded(getPrice());
}

Recommended to allow this function to be called only once.

Updates

Lead Judging Commences

inallhonesty Lead Judge
6 months ago
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doesn't check the token supply, making it possible to mint over the MAX

Incorrect `MAX_TOTAL_SUPPLY` check in the `veRAACToken::lock/extend` function of `veRAACToken` could harm locking functionality

RAACMinter.mintRewards() emits incorrect event value when called

suggestion is something that is done by ERC20.mint() function

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doesn't check the token supply, making it possible to mint over the MAX

Incorrect `MAX_TOTAL_SUPPLY` check in the `veRAACToken::lock/extend` function of `veRAACToken` could harm locking functionality

RAACMinter.mintRewards() emits incorrect event value when called

suggestion is something that is done by ERC20.mint() function

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.