Core Contracts

Summary

If the boost period passes a safety check in the TimeWeightedAverage, it can cause calls to the lock or increase functions to revert, leading to a DoS (Denial of Service) attack on the veRAAC token.

Vulnerability Details

Example Scenario:

Bob wants to lock an amount of RAAC tokens in the veRAAC contract to participate in governance. Bob is the first user to lock his RAAC tokens.

When a liquidity provider locks RAAC tokens or increases their locked amount, the protocol updates the boost state by calling the internal function _updateBoostState (L-584).

The function updateBoostPeriod (L-137) in the BoostCalculatorLibrary updates the time-weighted period of the boost state:

• If no period exists, it creates one.

• If a period has ended, it creates a new one.

• Otherwise, it calls updateValue.

Bob’s First Lock:

Since Bob is the first user, a new boost period is created, and totalDuration is initially set to 7 days (boostWindow), as seen here:

Bob Increases His Locked Amount (After 3 Days):

• The boost state is updated again.

• This time, the function updateValue is called instead of creating a new period.

• The function updateValue (L-134) in the TimeWeightedLibrary updates the value and adds the duration between lastUpdateTime and the current timestamp.

• The new totalDuration becomes 7 days + 3 days = 10 days.

Alice Tries to Lock Her RAAC Tokens (After 5 More Days):

• Alice tries to lock her tokens 8 days after Bob’s initial period was created.

• The function createPeriod is called again because the elapsed time (8 days) exceeds the boostWindow (7 days).

• However, this call will revert due to the following check at the beginning of createPeriod in TimeWeightedLibrary:

startTime = timestamp when Bob created the period + 8 days,

self.startTime + self.totalDuration =timestamp when Bob created the period + 10 days,

Even though the period should have elapsed, the call fails, preventing Alice from locking her tokens.

In order to run this coded POC you will have to add foundry to the project to do so you will have to follow 4 steps :

run npm install --save-dev @nomicfoundation/hardhat-foundry

add require("@nomicfoundation/hardhat-foundry"); to the hardhat.config file

run npx hardhat init-foundry

remove The ReserveLibraryMock from the test folder because this file countain errors that will make the compilation imposible for foundry.

you can now copy paste this code in a solidity file in the test folder and

run forge test --mt test_lockBug -vv.

Impact

• The veRAAC token becomes temporarily DoSed, as new users cannot lock their tokens until the total duration elapsed.

• This could disrupt governance and prevent new liquidity providers from participating.

Tools Used

Foundry

Recommendations

The protocol should add a value to store the initial duration and use it fot the safety check of the createPeriod function.