Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect calculation of the new voting power when lock is increased

vs_

Summary

Incorrect calculation of the new voting power when lock is increased

Vulnerability Details

Following is increase lock function

function increase(uint256 amount) external nonReentrant whenNotPaused {
// Increase lock using LockManager
_lockState.increaseLock(msg.sender, amount);
_updateBoostState(msg.sender, locks[msg.sender].amount);
​
// Update voting power
LockManager.Lock memory userLock = _lockState.locks[msg.sender];
(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
userLock.amount + amount,
userLock.end
);
​
// Update checkpoints
uint256 newPower = uint256(uint128(newBias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
​
// Transfer additional tokens and mint veTokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_mint(msg.sender, newPower - balanceOf(msg.sender));
​
emit LockIncreased(msg.sender, amount);
}
​
/**

It calls increase lock function for msg.sender by increasing the lockj amount by amount value as follows

function increaseLock(
LockState storage state,
address user,
uint256 additionalAmount
) internal {
Lock storage lock = state.locks[user];
if (!lock.exists) revert LockNotFound();
if (lock.end <= block.timestamp) revert LockExpired();
// Maximum lock amount
if (lock.amount + additionalAmount > state.maxLockAmount) revert AmountExceedsLimit();
// Maximum total locked amount
// if (state.totalLocked + additionalAmount > state.maxTotalLocked) revert AmountExceedsLimit();
==> lock.amount += additionalAmount;
state.totalLocked += additionalAmount;
​
emit LockIncreased(user, additionalAmount);
}

So the user lock amount is updated initially

But when updation of voting power is done it wrongly adds amount to the user lock.amount leading to double increase in amount of locked tokens which is incorrect

(int128 newBias, int128 newSlope) = _votingState.calculateAndUpdatePower(
msg.sender,
===> userLock.amount + amount,
userLock.end
);

Due to this voting power increases by 2 times even when only half of the tokens were locked.

Impact

Incorrect voting power updated.

Tools Used

Recommendations

don't add amount to userLock.amount when calculating the new power.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doubles the voting power of users

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!