Core Contracts

Summary

The lock() function enforces a total supply limit check by comparing totalSupply() + amount against MAX_TOTAL_SUPPLY. However, the amount represents the raw RAAC tokens locked, while the number of veRAAC tokens minted is derived from a calculation based on the lock’s duration and weight. This discrepancy could lead to a mismatch between the intended total supply limit and the actual veRAAC token supply.

Vulnerability Details

In the lock() function, the following check is used:

Here, amount is the raw amount of RAAC tokens the user is locking. However, the contract mints veRAAC tokens based on a formula that takes into account the lock’s duration and weight. This means the minted veRAAC tokens may not be equal to the raw amount locked.

The total supply limit (MAX_TOTAL_SUPPLY) appears to be intended for the veRAAC token supply. By adding the raw token amount to totalSupply(), the check might either:

• Over-restrict the minting process if the calculated veRAAC tokens are lower than the raw amount, or

• Fail to properly enforce the intended cap if the calculated tokens exceed the raw amount.

This issue exists in the lock() function:

The mismatch arises because the veRAAC tokens minted later are computed via:

Therefore, the supply limit is being checked against the raw amount, not the resulting newPower.

Impact

This discrepancy may lead to incorrect enforcement of the total supply cap. This could either prevent users from locking tokens when they actually should be able to (if the raw amount is higher than the minted veRAAC) or allow the veRAAC supply to exceed the intended limit (if the conversion yields a higher value). Either scenario might impact the protocol’s tokenomics, governance, and reward distribution mechanisms.

Tools Used

Manual Review

Recommended Mitigation

Modify the check to use the calculated mint amount (e.g., newPower) instead of the raw amount. For example: