Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Last Claim Time Update in `claimRewards()` function

maglov

Summary

The claimRewards() function does not update the user's last claim time (lastClaimTime) after successfully transferring rewards. This omission can lead to incorrect reward calculations in future claims and potentially allow users to claim rewards multiple times within the same distribution period.

Impact

  1. Incorrect Reward Calculations:

    • The _calculatePendingRewards() function relies on the lastClaimTime to determine the time elapsed since the user's last claim. Without updating this value, future reward calculations may be incorrect, leading to unfair distributions.

  2. Potential Double-Spending:

    • A user could potentially claim rewards multiple times within the same distribution period if the lastClaimTime is not updated, leading to double-spending of rewards.

  3. Violation of Time-Weighted Reward Design:

    • The contract is designed to distribute rewards based on time-weighted averages. Failing to update the lastClaimTime undermines this design, as the contract cannot accurately track the time since the user's last claim.

Tools Used

Manual Review

Recommendations

Add a call to _updateLastClaimTime(user) after transferring rewards to the user:

function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) {
if (user == address(0)) revert InvalidAddress();
uint256 pendingReward = _calculatePendingRewards(user);
if (pendingReward == 0) revert InsufficientBalance();
// Reset user rewards before transfer
userRewards[user] = totalDistributed;
// Transfer rewards
raacToken.safeTransfer(user, pendingReward);
// Update the last claim time
_updateLastClaimTime(user);
emit RewardClaimed(user, pendingReward);
return pendingReward;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

_updateLastClaimTime not properly used to track rewards claim time

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.