Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Double amount accounting in power calculation

dentonylifer

Summary

Double amount accounting in power calculation in increase() function leads to inflated power calculation and excessive veTokens minting.

Vulnerability Details

Link

Users can increase their lock by some amount in order to increase their voting power and receive more veRAAC tokens:

// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);

The issue is _lockState.locks[msg.sender] state variable was already updated in _lockState.increaseLock(msg.sender, amount) call:

function increaseLock(
LockState storage state,
address user,
uint256 additionalAmount
) internal {
Lock storage lock = state.locks[user];
//...
lock.amount += additionalAmount;
}

But function calculateAndUpdatePower assumes that userLock wasn't updated and adds additional amount again:

LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
>>> userLock.amount + amount, <<<
userLock.end
);

Additional voting power and tokens minted will be twice bigger than should.

Impact

Double amount accounting in power calculation in increase() function leads to inflated power calculation and excessive veTokens minting.

Tools Used

Manual review.

Recommendations

LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
- userLock.amount + amount,
+ userLock.amount,
userLock.end
);
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doubles the voting power of users

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.