Core Contracts

Summary

The MAX_LOCK_DURATION constant is set to 1460 days instead of 1461 days for a 4-year period, allowing users to withdraw tokens one day earlier than intended.

Vulnerability Details

In veRAACToken.sol, the MAX_LOCK_DURATION constant is defined as:

This value is incorrect as it doesn't account for leap years. A 4-year period contains:

• 3 years × 365 days = 1095 days

• 1 leap year = 366 days
  Total = 1461 days

The current implementation is off by 1 day, which means locks set for the maximum duration will expire one day earlier than intended.

Impact

• Users can withdraw their tokens one day earlier than the intended 4-year maximum lock period

• This slightly reduces the maximum voting power duration

• Creates inconsistency between documented and actual maximum lock duration

Recommendations

Update constant to correct value