Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`FeeCollector::claimRewards` Function Allows Anyone to Claim Rewards for Arbitrary Addresses via Parameter

zgczgc

Summary

The FeeCollector::claimRewards function lacks access control and permits executing reward claims for any address through parameter input, potentially violating the intended authorization of reward recipients.

Vulnerability Details

function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) { <==@found
if (user == address(0)) revert InvalidAddress();
uint256 pendingReward = _calculatePendingRewards(user);
if (pendingReward == 0) revert InsufficientBalance();
userRewards[user] = totalDistributed;
raacToken.safeTransfer(user, pendingReward);
emit RewardClaimed(user, pendingReward);
return pendingReward;
}

Impact

  • Any address can trigger reward claims for other users

  • Potential violation of reward owners' authorization intent

  • Risk of rewards being claimed at inappropriate times

Tools Used

  • Manual Review

Recommendations

  1. Implement access control restricting to reward owners or authorized addresses:

+ mapping(address => address) public isAuthorized;
​
function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) {
if (user == address(0)) revert InvalidAddress();
+ if (msg.sender != user && !isAuthorized[user][msg.sender]) revert Unauthorized();
uint256 pendingReward = _calculatePendingRewards(user);
if (pendingReward == 0) revert InsufficientBalance();
userRewards[user] = totalDistributed;
raacToken.safeTransfer(user, pendingReward);
emit RewardClaimed(user, pendingReward);
return pendingReward;
}

  1. Remove address parameter to enforce self-claim only:

-function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) {
+function claimRewards() external override nonReentrant whenNotPaused returns (uint256) {
+ address user=msg.sender;
if (user == address(0)) revert InvalidAddress();
uint256 pendingReward = _calculatePendingRewards(user);
if (pendingReward == 0) revert InsufficientBalance();
userRewards[user] = totalDistributed;
raacToken.safeTransfer(user, pendingReward);
emit RewardClaimed(user, pendingReward);
return pendingReward;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!