Core Contracts

Summary

In veRAACToken.sol, increase()function will increase the amount of locked RAAC tokens without changing the lock time, calculating the new bias and slope accordingly based on the additional amount. However, the additional amount passed is over-inflated due to incorrect addition.

Vulnerability Details

1. In the above code snippet (snippet #1), the function will call _lockState.increaseLock(msg.sender, amount)internally.

2. In this function, the user's lock amount is updated, adding the additionalAmount, as seen in Line 15 of snippet #2 below.

   function increaseLock(

   LockState storage state,

   address user,

   uint256 additionalAmount

   ) internal {

   Lock storage lock = state.locks[user];

   if (!lock.exists) revert LockNotFound();

   if (lock.end <= block.timestamp) revert LockExpired();

   // Maximum lock amount

   if (lock.amount + additionalAmount > state.maxLockAmount) revert AmountExceedsLimit();

   // Maximum total locked amount

   // if (state.totalLocked + additionalAmount > state.maxTotalLocked) revert AmountExceedsLimit();

   lock.amount += additionalAmount;

3. Back to the increase()function, it now updates the boost state and then retrieves the msg.sender's lock struct. (See line 7 in code snippet #1). The amount parameter for msg.sender would already have added the additionalAmount

4. In the next line, _votingState.calculateAndUpdatePower()is called, passing userLock.amount + amountas the amount. This is over-inflating the user's lock amount, adding additionalAmount a second time

5. In _votingState.calculateAndUpdatePower(), this function calculates the rate at which the user's voting power decays, and the rate is dependent on the amount locked as well as duration of the lock. Since amount passed into this function is more than the actual additionalAmount, this will hence lead to a higher bias and steeper slope. User will experience faster voting decay than actual.

Impact

Users who increased their RAAC token lock amount will have their voting power decay at a faster rate than actual.

Tools Used

Manual

Recommendations

Pass userLock.amountinstead of userLock.amount + amountwhen calling _votingState.calculateAndUpdatePower()function.