Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Checkpoint not written in veRAACToken.emergencyWithdraw()

elser17

Summary

Checkpoint not written in veRAACToken.emergencyWithdraw()

Vulnerability Details

veRAACToken contract uses checkpoints to track the historical voting power every user has had. Whenever a user gets their voting power updated, a Checkpoint is added with current block number to reflect how the voting power has changed over time.

However, `emergencyWithdraw()` function does not write the mentioned checkpoint for caller, meaning that the votingPower after a user calls this functions will be 0 (as all their veRAACTokens are burnt) while the absence of a new Checkpoint indicates that user has still voting power.

Impact

Checkpoint is not written when it should, failing to correctly track the voting power of the caller address until they create a new Lock, which would be the expected behaviour of the contract and of the Checkpoints structure. This can potentially lead to rewards being allocated incorrectly if another contract uses the _checkpointState state variable as a source of truth to allocate rewards.

Tools Used

Manual testing

Recommendations

Write a new Checkpoint for caller when emergencyWithdraw() is called:

function emergencyWithdraw() external nonReentrant {
if (emergencyWithdrawDelay == 0 || block.timestamp < emergencyWithdrawDelay)
revert EmergencyWithdrawNotEnabled();
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
if (userLock.amount == 0) revert NoTokensLocked();
uint256 amount = userLock.amount;
uint256 currentPower = balanceOf(msg.sender);
delete _lockState.locks[msg.sender];
delete _votingState.points[msg.sender];
+ _checkpointState.writeCheckpoint(msg.sender, 0);
_burn(msg.sender, currentPower);
raacToken.safeTransfer(msg.sender, amount);
emit EmergencyWithdrawn(msg.sender, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::emergencyWithdraw doesn't update checkpoint - innacurate historical voting power, inconsistent state

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.