Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Calling veRAACToken.lock() multiple times will overwrite the previously set amount

elser17

Summary

Calling veRAACToken.lock() multiple times will overwrite the previously set amount

Vulnerability Details

When user calls veRAACToken.lock(), a new Lock is created with input amount, user sends RAACTokens to contract and gets minted veRAACTokens in a 1:1 ratio. However, lock() can be called multiple times and a new Lock will be created overwriting the amount of the previous one.

When Lock finishes, user will not be able to withdraw() all the deposited RAACTokens due to overwritten value.

Impact

User could reach a point in which they cannot withdraw all the RAACTokens originally deposited or redeem or the received veRAACTokens. As they may not be familiarized with how the protocol works, the will try to enlarge their position calling lock() instead of increase()/extend(), leading to the mentioned scenario. They could also use this bug on purpose in case they want to redeem part of their veRAACTokens and hold the rest of them.

Tools Used

Manual review

Recommendations

Do not allow a user with a Lock created to call lock() function again, or allow this but the new Lock must track the accumulated amount of previous Locks, then `createLock()` function from LockManager library should be updated:

function createLock(
LockState storage state,
address user,
uint256 amount,
uint256 duration
) internal returns (uint256 end) {
// Validation logic remains the same
if (state.minLockDuration != 0 && state.maxLockDuration != 0) {
if (duration < state.minLockDuration || duration > state.maxLockDuration)
revert InvalidLockDuration();
}
​
if (amount == 0) revert InvalidLockAmount();
​
end = block.timestamp + duration;
state.locks[user] = Lock({
- amount: amount,
+ amount: state.locks[user].amount + amount,
end: end,
exists: true
});
​
state.totalLocked += amount;
​
emit LockCreated(user, amount, end);
return end;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::lock called multiple times, by the same user, leads to loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.