Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

User bypassing the maximum lock amount for RAACToken

0xkann

Summary

The lock function in the veRAACToken.sol allows users to lock their RAAC tokens for a specified duration, granting them voting power. However, due to missing validation checks, users can bypass the maximum lock amount restriction by repeatedly calling the function.

Vulnerability Details

The function lock(uint256 amount, uint256 duration) enforces a maximum lock amount (MAX_LOCK_AMOUNT). However, there is no validation to check if the caller has already locked tokens previously. This allows a user to repeatedly call the function and lock additional tokens, exceeding the intended limit.

if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit();

The above check only applies to the current transaction and does not consider the cumulative locked amount by the user. Thus, a user can call lock multiple times with amounts below the MAX_LOCK_AMOUNT, effectively bypassing the restriction.

function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
if (amount == 0) revert InvalidAmount();
if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit(); //@audit user can call multiple times this function and lock more than the max lock amount
if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
if (duration < MIN_LOCK_DURATION || duration > MAX_LOCK_DURATION)
revert InvalidLockDuration();
​
// Do the transfer first - this will revert with ERC20InsufficientBalance if user doesn't have enough tokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Calculate unlock time
uint256 unlockTime = block.timestamp + duration;
// Create lock position
_lockState.createLock(msg.sender, amount, duration);
_updateBoostState(msg.sender, amount);
​
// Calculate initial voting power
(int128 bias, int128 slope) = _votingState.calculateAndUpdatePower(
msg.sender,
amount,
unlockTime
);
​
// Update checkpoints
uint256 newPower = uint256(uint128(bias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
_mint(msg.sender, newPower);
// Mint veTokens
​
emit LockCreated(msg.sender, amount, unlockTime);
}

Impact

Bypassing Lock Limits: Users can exceed the intended maximum lock amount by repeatedly locking tokens, leading to potential economic imbalances and unfair advantages in voting power.

Tools Used

Manual Review

Recommendations

Enforce a Cumulative Lock Check: Introduce a validation step to check the total amount of tokens a user has already locked before allowing a new lock transaction.

if (_lockState.getUserLockedAmount(msg.sender) + amount > MAX_LOCK_AMOUNT) {
revert AmountExceedsLimit();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`veRAACToken::lock` function doesn't check MAX_TOTAL_LOCKED_AMOUNT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!