Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Initialization of `RAACMinter::lastEmissionUpdateTimestamp` Bypasses Emission Rate Update Cooldown

zgczgc

Summary

The initialization of RAACMinter::lastEmissionUpdateTimestamp as block.timestamp - BASE_EMISSION_UPDATE_INTERVAL allows the first call to RAACMinter::updateEmissionRate to bypass the time interval check. This occurs because the timestamp comparison block.timestamp < lastEmissionUpdateTimestamp + emissionUpdateInterval becomes mathematically impossible to enforce during the first update attempt.

Vulnerability Details

constructor(
address _raacToken,
address _stabilityPool,
address _lendingPool,
address initialOwner
) Ownable(initialOwner) {
if (_raacToken == address(0) || _stabilityPool == address(0) || _lendingPool == address(0) || initialOwner == address(0)) {
revert ZeroAddress();
}
raacToken = IRAACToken(_raacToken);
stabilityPool = IStabilityPool(_stabilityPool);
lendingPool = ILendingPool(_lendingPool);
emissionRate = INITIAL_RATE / BLOCKS_PER_DAY;
lastUpdateBlock = block.number;
benchmarkRate = emissionRate;
lastEmissionUpdateTimestamp = block.timestamp - BASE_EMISSION_UPDATE_INTERVAL; <==@found
emissionUpdateInterval = BASE_EMISSION_UPDATE_INTERVAL;
_grantRole(DEFAULT_ADMIN_ROLE, initialOwner);
_grantRole(PAUSER_ROLE, initialOwner);
_grantRole(UPDATER_ROLE, initialOwner);
}

Impact

  • First emission rate update can be executed without waiting for the required interval

  • Potential premature emission rate adjustments affecting tokenomics

Tools Used

  • Manual Review

Recommendations

RAACMinter::lastEmissionUpdateTimestamp is initialized to block.timestamp

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!