Core Contracts

Summary

veToken implementation is flawed

Vulnerability Details

The veRAACToken implementation is flawed. veTokens are minted from locking RAACToken, the longer locking, the more veToken one will receive. Typically veToken should reprensent user's voting power and this power should be decayed wtih time elapsed. However in this veRAACToken contract, veTokens are minted as ERC20 tokens, which will stay constant since the beginning of lock, provide the user does not increase/extend. Therefore whenever balanceOf(user) or getTotalVotingPower()/totalSupply() are called, the contract returns the ERC20 balance of veToken, which do not represnet user's voting power or all the total voting power.

Gauge reward distribution and boot are based on the voting power of veToken, which will result in incorrect calculation.

Impact

Tools Used

manual

Recommendations