Core Contracts

Summary

The mintRewards function in RAACMinter smart contract is incorrectly minting and distributing RAAC tokens. The current logic assumes that excess tokens are directly transferred from the contract to the user, when in reality, the excess tokens are held in the stabilityPool contract. This leads to discrepancies in minting behavior and possible inconsistencies in token distribution.

Vulnerability Details

The mintRewards function does not correctly handle the minting process. It assumes that the excessTokens balance represents the amount available for distribution. The tick() function, which is responsible for minting RAAC tokens, tracks the tokens minted to the stabilityPool as excessTokens. However, the current implementation erroneously mints the missing tokens directly to the contract instead of the stabilityPool.

This can lead to errors in token distribution.

Impact

• Incorrect Token Distribution: Users may not receive the correct amount of tokens if the excessTokens are insufficient, as new tokens are minted directly to the contract instead of the stabilityPool.

• Minting Inefficiencies: If the contract itself is the recipient of newly minted tokens instead of the stabilityPool, it could result in an inefficient distribution mechanism, leading to errors in tracking and sending tokens to users.

Tools Used

Manual Code Review

Recommendations

• Fix Minting Logic: Modify the mintRewards function to mint the necessary tokens directly to the stabilityPool instead of the contract. Ensure that the minting logic aligns with the intended design where the stabilityPool is responsible for distributing tokens to the users.

• Transfer from stabilityPool: After minting tokens to the stabilityPool, transfer the required amount of tokens to the user directly from the stabilityPool to avoid discrepancies.

  function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {

  if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();

  uint256 toMint = excessTokens >= amount ? 0 : amount - excessTokens;

  excessTokens = excessTokens >= amount ? excessTokens - amount : 0;

  ​

  if (toMint > 0) {

  - raacToken.mint(address(this), toMint);

  + raacToken.mint(address(stabilityPool), toMint);

  }

  - raacToken.safeTransfer(to, amount);

  + raacToken.safeTransferFrom(msg.sender, to, amount);

  emit RAACMinted(amount);

  }

  ​