Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Initialization of `RAACMinter::lastEmissionUpdateTimestamp` Bypasses Emission Rate Update Cooldown

zgczgc

Summary

The initialization of RAACMinter::lastEmissionUpdateTimestamp as block.timestamp - BASE_EMISSION_UPDATE_INTERVAL allows the first call to RAACMinter::tick to bypass the time interval check. This occurs because the timestamp comparison block.timestamp >= lastEmissionUpdateTimestamp + emissionUpdateInterval always be true during the first tick attempt.

Vulnerability Details

function tick() external nonReentrant whenNotPaused {
if (emissionUpdateInterval == 0 || block.timestamp >= lastEmissionUpdateTimestamp + emissionUpdateInterval) { <==@found
updateEmissionRate();
}
uint256 currentBlock = block.number;
uint256 blocksSinceLastUpdate = currentBlock - lastUpdateBlock;
if (blocksSinceLastUpdate > 0) {
uint256 amountToMint = emissionRate * blocksSinceLastUpdate;
if (amountToMint > 0) {
excessTokens += amountToMint;
lastUpdateBlock = currentBlock;
raacToken.mint(address(stabilityPool), amountToMint);
emit RAACMinted(amountToMint);
}
}
}

Impact

  • First emission rate update can be executed without waiting for the required interval

  • Potential premature emission rate adjustments affecting tokenomics

Tools Used

  • Manual Review

Recommendations

RAACMinter::lastEmissionUpdateTimestamp is initialized to block.timestamp

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!