Core Contracts

Summary

The extend function in veRAACToken.sol enables users to extend any existing lock by a time range 0 < x < 4 years. This introduces the potential for an expensive consecutive block MEV attack, where an attacker can momentarily control the entire TVL of a Uniswap v2 pool (since RaacToken is a fee-on-transfer token, making Uniswap v3 incompatible).

The exploit allows the attacker to vote on governance proposals using liquidity they don’t truly hold long-term, giving them an unfair advantage over legitimate veRAAC holders.

Vulnerability Details

Initial Lock Creation

• Alice creates a minimal lock during the dApp’s genesis:

Block Timing & Lock Extension

As time passes and her lock nears expiry, Alice identifies a future window where she will validate two consecutive blocks.

• By calculating the time difference between the current block and the target consecutive blocks, she times the extension perfectly so that her lock expires right after her first block(Assuming 12 seconds per block for accurate timing).

MEV Execution — First Block (Voting with TVL)
In her first block, Alice:

• Swaps ETH for as much RaacToken as possible from a Uniswap v2 pool.

• Locks the purchased tokens using increase.

• Casts her vote with the temporarily acquired voting power.

MEV Execution — Second Block

In her second block, Alice:

• Withdraws her locked tokens using withdraw().

• Rebalances the Uniswap v2 pool, selling the tokens back.

The Problem — Permanent Snapshot in Governance:

• When Alice voted, the Governance contract stored her voting power as a snapshot.

• Even though she quickly exited her position, the vote remains valid for the proposal’s lifetime.

• This gives Alice massive, temporary influence. Without holding any veRaac post-exploit.

Resources:
https://research.numeus.xyz/p/consecutive-blocks-ethereum

Impact

While the attack requires a wealthy attacker due to the need to momentarily control a large portion of liquidity, it is not inherently expensive in terms of losses. Regardless of that, these circumstances make this attack highly unlikely to happen.

• Allows for attacker to vote with DEX TVL worth of RaacToken.

Tools Used

Foundry

Recommendations

A reasonable extension time minimum must be implemented.
If small values are desired, they have to be larger than 7 blocks to avoid these types of attack. — inspired by Kraken’s record of mining 7 consecutive blocks in 2023.