Core Contracts

Summary:

The RAAC reward distribution in StabilityPool uses a simple pro-rata (userDeposit / totalDeposits) approach at withdrawal time. Early withdrawers can claim a large fraction of the total RAAC if the pool’s RAAC balance is high.

Vulnerability Details:

Participants who withdraw first may get a bigger portion of newly added RAAC.

Impact:

This leads to “first-withdrawer advantage” and a potentially unfair reward system, though it doesn’t strictly break the system.

Tools Used:

• Manual review of distribution logic

• Comparison with typical reward indexing

Recommendations:

• Use a reward index approach, tracking each deposit’s entitlement over time.

• Document the design if pro-rata is intentionally naive.