Core Contracts

Summary

An attacker can use a flash loan to temporarily deposit a large amount of RToken into the StabilityPool right before rewards are distributed. This allows them to take an unfairly high percentage of RAAC rewards. After claiming the rewards, the attacker withdraws their RToken and returns the borrowed flash-loaned funds. This process can be repeated in every reward cycle, draining the pool.

Vulnerability Details

In StabilityPool.sol:

Attack Steps

1. Monitor RAAC rewards – The attacker watches when new RAAC tokens are added to StabilityPool (via RAACMinter.tick() function).

2. Flash Loan RToken – The attacker takes a flash loan of crvUSD, deposits it into LendingPool, and mints a large amount of RToken.

3. Deposit RToken into StabilityPool – The attacker deposits the RToken, making it appear as if they are a major contributor.

4. Claim Disproportionate Rewards – Since the rewards are distributed based on the amount of RToken, the attacker gets a large share of the RAAC rewards.

5. Withdraw RToken & Repay Flash Loan – The attacker withdraws the RToken, converts it back to crvUSD, and repays the flash loan—all in a single transaction.

6. Repeat – The attacker can repeat this exploit every time RAAC rewards are distributed.

Impact

High – The attacker can continuously drain the reward pool, reducing rewards for honest users.

Tools Used

Manual Review

Recommendations

• Use a time-based reward calculation to prevent flash loan exploits.

• Require a minimum deposit duration before rewards are claimable.