Core Contracts

Summary

The increase function in veRAACToken.sol contains a logical error where the amount being added is double-counted during the accounting process. This leads to two vulnerabilities:

1. Excess Voting Power:
   Users receive inflated voting power when using increase compared to using deposit directly.

2. Underflow-Induced Denial:
   The same miscalculation leads to an underflow error when users attempt to perform certain sequences of increases, causing the function to revert and effectively locking users out from further increasing their stake.

Vulnerability Details

A. Double Accounting in increase Function

The core issue lies in the erroneous addition of the increase amount to the user’s accounting twice. This grants the user more voting power than intended.

Direct deposit:

Using increase (Inflated result):

The second approach improperly grants nearly double the intended voting power due to the double-counting issue.

Code Location of the Typo:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L260

B. Underflow-Induced Reverts (Denial of Further Increases)

The faulty logic also causes underflows in the newBias calculation when users attempt a smaller increase after a larger one. This results in a revert and denies further interaction with the lock.

Sequence That Triggers Underflow:

Create initial Lock:

Increase lock by some amount:

Try to increase lock again by an amount smaller than the previous one:

The code assumes that the user’s balanceOf will always be larger or equal to the resulting newBias value. However, due to the previously mentioned typo, this invariant is broken, leading to a constant underflow revert for the user.

Code Location of invariant:
https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L270

Impact

Voting power Inflation:

• Users attain larger amounts of voting power than what their deposits should yield.

Denial of further increases:

• Consequent calls to veRaacToken.increase(amount) of lower amounts will be denied.

Tools Used

Foundry