Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

veRaac total supply limit can be passed with increase and extend

aksoy

Summary

The increase and extend functions in the veRAACToken contract allow users to add more RAAC tokens to an existing lock or extend the lock duration, respectively. However, neither function includes a check to ensure that the total supply of veRAAC tokens does not exceed MAX_TOTAL_SUPPLY. This oversight allows users to mint veRAAC tokens beyond the intended supply cap.

Vulnerability Details

The increase function enables users to lock additional RAAC tokens and mint veRAAC tokens accordingly. However, it does not check supply limit.

function increaseLock(
LockState storage state,
address user,
uint256 additionalAmount
) internal {
Lock storage lock = state.locks[user];
if (!lock.exists) revert LockNotFound();
if (lock.end <= block.timestamp) revert LockExpired();
// Maximum lock amount
if (lock.amount + additionalAmount > state.maxLockAmount) revert AmountExceedsLimit();
// Maximum total locked amount
// if (state.totalLocked + additionalAmount > state.maxTotalLocked) revert AmountExceedsLimit();
lock.amount += additionalAmount;
state.totalLocked += additionalAmount;
​
emit LockIncreased(user, additionalAmount);
}

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/governance/LockManager.sol#L152

Similarly, the extend function can also mint new veRAAC tokens if extending the lock duration increases the voting power.

Impact

The MAX_TOTAL_SUPPLY limit can be bypassed, allowing more veRAAC tokens to exist than intended.

Tools Used

Manual

Recommendations

Before minting new veRAAC tokens in both increase and extend, check whether the total supply exceeds MAX_TOTAL_SUPPLY.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::increase doesn't check the token supply, making it possible to mint over the MAX

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.