Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incomplete token allocation in `StabilityPool::depositRAACFromPool`

0xlouistsai

Summary

The StabilityPool::depositRAACFromPool function does not implement the expected token allocation logic, as indicated by a TODO comment in the function. This results in managers not receiving their allocated tokens, leading to unintended behavior where deposited RAAC tokens are not properly distributed.

Vulnerability Details

Problem description

In the RAACLiquidityPool::depositRAACFromPool function, tokens are successfully transferred from the liquidity pool to the contract. However, the intended allocation of these tokens to managers is not implemented, leaving them unaccounted for.

Affected Code in RAACLiquidityPool::depositRAACFromPool

/**
* @notice Deposits RAAC tokens from the liquidity pool.
* @param amount Amount of RAAC tokens to deposit.
*/
// @audit-issue incomplete issue
function depositRAACFromPool(uint256 amount) external onlyLiquidityPool validAmount(amount) {
uint256 preBalance = raacToken.balanceOf(address(this));
​
raacToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 postBalance = raacToken.balanceOf(address(this));
if (postBalance != preBalance + amount) revert InvalidTransfer();
​
// TODO: Logic for distributing to managers based on allocation
​
emit RAACDepositedFromPool(msg.sender, amount);
}

Impact

  • Token mismanagement: Deposited RAAC tokens remain unallocated and cannot be accessed by managers.

  • Unintended contract behavior: Expected token distribution logic is missing, leading to incorrect fund flows.

  • Potential fund loss: Managers may not receive their due allocations, affecting the protocol's token distribution mechanism.

Tools Used

Manual Review

Recommendations

Complete the token allocation mechanism

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.