Core Contracts

Summary

A malicious user can spam deposits and withdrawals within the same block to game the reward system.

If there's a flash loan vulnerability, attackers can deposit large amounts temporarily, farm rewards, and withdraw immediately.

Vulnerability Details

Introduce a minimum deposit duration.

Implement anti-flash loan mechanisms (e.g., requiring deposits to stay locked for a short period).

Impact

Tools Used

Recommendations

mapping(address => uint256) public lastDepositTime;

uint256 public constant MIN_DEPOSIT_TIME = 10 minutes;

function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount)

{ require(block.timestamp >= lastDepositTime[msg.sender] + MIN_DEPOSIT_TIME, "Too soon to deposit again");

lastDepositTime[msg.sender] = block.timestamp; _update();

rToken.safeTransferFrom(msg.sender, address(this), amount); uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);

deToken.mint(msg.sender, deCRVUSDAmount); userDeposits[msg.sender] += amount; _mintRAACRewards();

emit Deposit(msg.sender, amount, deCRVUSDAmount); }