Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

FeeCollector's Time-Weighted Distribution not impelmented leads to attacker stealing user rewards

holydevoti0n

Vulnerability Details

According to FeeCollector docs:

The FeeCollector is designed to implement a time-weighted reward distribution to veRAAC holders (claimable by address).

However, in _calculatePendingRewards():

function _calculatePendingRewards(address user) internal view returns (uint256) {
uint256 userVotingPower = veRAACToken.getVotingPower(user);
if (userVotingPower == 0) return 0;
​
uint256 totalVotingPower = veRAACToken.getTotalVotingPower();
if (totalVotingPower == 0) return 0;
// @audit-issue vulnerable to rewards manipulation.
uint256 share = (totalDistributed * userVotingPower) / totalVotingPower;
return share > userRewards[user] ? share - userRewards[user] : 0;
}

An attacker can acquire a large amount of veRRACToken and lock it for the maximum duration to increase his voting power. This allow him to steal rewards from users that have been holding veRAAC for a longer time.

Impact

  • Steal of rewards from legit users due to not implementing a time-weighted rewards distribution as mentioned in the documentation.

  • Broken implementation as it doesn't use the period created in the through the TimeWeightedAverageto distribute those funds.

Tools Used

Manual Review

Recommendations

Implement proper time-weighted reward calculation like the one done in BaseGauge.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.