Core Contracts

Summary

The RAACMinter contract implements a dynamic emissions schedule for minting and distributing RAAC tokens. However, a critical flaw exists in its reward distribution mechanism: there is a mismatch between where excess tokens are minted and where they are expected to reside. Specifically, the tick() function mints tokens to the StabilityPool while increasing the excessTokens counter in RAACMinter. Later, the mintRewards() function attempts to transfer tokens from RAACMinter's balance based on the excessTokens counter. This misalignment leads to failed transfers (insufficient balance) and interrupts the proper distribution of rewards.

Vulnerability Details

The flaw arises from the following logic:

1. In the tick() function:

• After calculating the amount to mint (amountToMint), the contract increases excessTokens:

  This means that while excessTokens is increased, the newly minted tokens are sent directly to the StabilityPool, not RAACMinter.

  ​

  if (amountToMint > 0) {

  excessTokens += amountToMint; // Increase tracking variable

  lastUpdateBlock = currentBlock;

  raacToken.mint(address(stabilityPool), amountToMint); //@audit Mint tokens to StabilityPool

  emit RAACMinted(amountToMint);

  }

2 In the mintRewards() function:

• The function is called by StabilityPool to distribute rewards:

  function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {

  if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();

  uint256 toMint = excessTokens >= amount ? 0 : amount - excessTokens;

  excessTokens = excessTokens >= amount ? excessTokens - amount : 0;

  if (toMint > 0) {

  raacToken.mint(address(this), toMint); // Mints tokens to RAACMinter

  }

  raacToken.safeTransfer(to, amount); //@audit Tries to transfer tokens from RAACMinter’s balance

  emit RAACMinted(amount);

  }

Here, the function calculates toMint based on the excessTokens counter and then expects that any shortage in RAACMinter’s balance will be remedied by minting additional tokens. However, because tick() mints tokens directly to StabilityPool, RAACMinter’s balance is not increased accordingly. This will cause the subsequent safeTransfer() call to revert due to insufficient token balance.

PoC

Setup MockStabilityPool, I just added two functions to the existing MockStabilityPool contract because it is only the stablilityPool that can call the mintRewards functions in the RAACMinter contract.

I added:

• setRAACMinter : to set the RAACMinter contract address, so as to be able call the mintRewards function.

• mintRewards: to call the mintRewards function in the RAACMinters contract.

the test its

output of the test

it revert with the error:

'ERC20InsufficientBalance("0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9", 0, 2)' Beacuse we are trying to send tokens from RAACMinter contract instead of the stabilityPool that we minted to in the tick function.

Impact

• Reward Distribution Breakdown: MintRewards() will revert when it attempts to transfer tokens not held by RAACMinter, preventing users from receiving their intended rewards.

• Protocol Incentive Failure: With rewards failing to distribute properly, the entire emissions mechanism is compromised, which can impact user participation and overall protocol trust.

• It will affect the token’s economics and the incentives that drive the protocol.

Tools Used

Manual Code Review

Recommendations

Align Minting Destination with Accounting:

• modify mintRewards() to transfer tokens directly from StabilityPool's balance rather than expecting them in RAACMinter.