Core Contracts

Summary

Stakers who stakes RToken in the StabilityPool receives DETokens which are 1:1 representation of their stake. The more they stake the more RAACTokens they can claim when its distrubuted to the StabilityPool. However, the current implementation of rewards claiming allows malicious stakers to drain the RAACToken rewards.

Vulnerability Details

How much a user is entitiled to gain is calculated in StabilityPool.sol::calculateRAACrewards(), which returns a portion of the RAACToken balance of the Pool proportional to the users staked amount / total staked amount.

The rewards are transferred to the users during the unstaking process in withdraw().

However a malicious users can simply withdraw 1 deToken again and again, and drain the rewards.

Lets walkthrough and example,

1. The pool has 100e18 rTokens staked.

2. The RAACToken balance of the pool is 1000e18.

3. The malicious staker has 10e18 rTokens staked. (entitled to 10% of the rewards)

Attack Path.

1. The malicious user calls withdraw() with 1 deCRVUSDAmount is an input.

2. The calculateRAACrewards() will return 100e18 amount of RAACTokens.

3. 1 deToken will be burned from the malicious user and he will gain 100e18 RAACTokens.

4. Since there is no tracking of claimed rewards, nor the distributed rewards are tracked internally, he can just repeat this process to drain the whole RAACToken balance of the Pool.

Impact

Any stakers can drain RAAC rewards from the StabilityPool

Tools Used

Manual Review

Recommendations

Implement a reward tracking mechanism to track the distributed rewards internally, track the rewards claimed by the users, and prevent them from claiming their entitled amount twice.