Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Redundant _mintRAACRewards call in `StabilityPool::deposit`

0xlouistsai

Summary

The StabilityPool::deposit function redundantly calls _mintRAACRewards, even though _update—which is invoked at the beginning of the function—already performs this action. This unnecessary duplication leads to inefficiencies in execution and increased gas costs.

Vulnerability Details

Problem description

In the StabilityPool::deposit function, _mintRAACRewards is explicitly called at the end of the function, despite already being invoked by _update. This results in an unnecessary additional function call and execution.

Affected Code in StabilityPool

/**
* @notice Allows a user to deposit rToken and receive deToken.
* @param amount Amount of rToken to deposit.
*/
function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
@> _update();
rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
deToken.mint(msg.sender, deCRVUSDAmount);
​
userDeposits[msg.sender] += amount;
@> _mintRAACRewards(); // @audit-issue This is already called by _update()
​
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}
​
function _update() internal {
_mintRAACRewards();
}

Impact

  • Unnecessary gas consumption: The redundant function call increases transaction costs for depositors.

  • Inefficient execution: The extra function call serves no additional purpose and can be removed without affecting functionality.

Tools Used

Manual Review

Recommendations

Modify StabilityPool::deposit by removing the extra _mintRAACRewards call at the end:

function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update();
rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
deToken.mint(msg.sender, deCRVUSDAmount);
​
userDeposits[msg.sender] += amount;
- _mintRAACRewards(); // @audit-issue This is already called by _update()
​
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.