Core Contracts

Summary:

MarketCreator allows users to deposit quote assets and redeem them for RAAC rewards. However, the code never decrements market.reward after redemption, letting multiple participants claim more rewards than intended.

Vulnerability Details:

In MarketCreator.sol, the calculateReward function uses:

But market.reward never changes after user redemption. Multiple participants can repeatedly deposit and redeem, each effectively receiving a fraction of the full market.reward, which can exceed the intended total.

Impact:

An attacker or normal user can infinitely claim RAAC tokens, draining the contract.

Tools Used:

• Manual code inspection

• Logical modeling of deposit/redeem flows

Recommendations:

• Deduct the claimed portion from market.reward to ensure the total distributed reward cannot exceed the initial allocation.

• Alternatively, track user shares at deposit time and reduce market.reward accordingly.