Core Contracts

Summary

The mintRewards function mints RAAC tokens unconditionally due to uninitialized and improperly managed excessTokens, allowing unlimited token minting if the stabilityPool is compromised.

Vulnerability Details

The excessTokens variable is declared but never initialized or updated outside of mintRewards. By default, it is 0. When excessTokens is 0 (always true in current code), toMint is calculated as amount - 0 = amount. The line excessTokens = excessTokens >= amount ? excessTokens - amount : 0 sets excessTokens to 0 because excessTokens is always 0. The contract mints toMint = amount and transfers amount to the user.

Since excessTokens is never replenished, every call to mintRewards mints new tokens equal to amount. If the stabilityPool is compromised, attackers can mint infinite RAAC tokens.

Impact

• Inflation Attack: Malicious actors can drain the protocol by minting unlimited RAAC tokens ( if stabilityPoolgets compromised )

• Token Devaluation: Uncontrolled minting devalues RAAC tokens, harming all holders.

Tools Used

manual review

Recommendations

Make changes to how excessTokens is calculated to make it suit how the protocol intend to use it.