Core Contracts

Summary

The RAACMinter contract's emergency shutdown mechanism, while successfully halting emissions, leads to an extended period of economic distortion during recovery. Due to the interaction between the benchmark rate and the maximum daily adjustment factor, it can take up to 48 days for emission rates to normalize after an emergency shutdown, resulting in significant deviations from intended token distribution.

Vulnerability Details

The emergencyShutdown function resets the emission rate to 0:

When operations resume, the emission rate gets set to the benchmark rate through calculateNewEmissionRate():

The issue manifests in two scenarios:

Low-to-High Recovery:

• Initial rate: 100 RAAC/day (minimum)

• After shutdown and restart: 1000 RAAC/day (benchmark)

• With 5% maximum daily adjustment: Takes 48 days to return to minimum rate

• Result: 48 days of excess emissions

High-to-Low Recovery:

• Initial rate: 2000 RAAC/day (example)

• After shutdown and restart: 1000 RAAC/day (benchmark)

• With 5% maximum daily adjustment: Takes 15 days to return to original rate

• Result: 15 days of reduced emissions

Impact

High - Extended periods of incorrect emissions (15-48 days depending on scenario)

In the low-to-high scenario:

Over 48 days:

Approximately 21,600 excess RAAC tokens emitted

In the high-to-low scenario:

Over 15 days:

Approximately 7,500 RAAC tokens under-emitted

Likelihood

Low - Emergency shutdowns are rare and severity depends on .

Recommendations

• Add a recovery mode that bypasses the adjustment factor limit

• Alternatively, store the pre-shutdown emission rate and allow it to be restored

• At minimum, document this behavior in the protocol specification and consider if the extended recovery period aligns with emergency response requirements.