Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Rewards aren't dripped, but dropped all at once

pyro

Summary

Rewards are dropped all at once allowing users to MEV them. Dripping mechanisms does not work as it's not implemented correctly.

Vulnerability Details

_processDistributions creates a time weighted average period that should in theory distribute all of the rewards over a 7 day period. However that is not the case as the rewards are added afterwards to totalDistributed += shares[0];, making that whole period useless and allowing users to exploit the sudden increase.

function _processDistributions(uint256 totalFees, uint256[4] memory shares) internal {
uint256 contractBalance = raacToken.balanceOf(address(this));
if (contractBalance < totalFees) revert InsufficientBalance();
​
if (shares[0] > 0) {
uint256 totalVeRAACSupply = veRAACToken.getTotalVotingPower();
if (totalVeRAACSupply > 0) {
TimeWeightedAverage.createPeriod(
distributionPeriod,
block.timestamp + 1,
7 days,
shares[0],
totalVeRAACSupply
);
totalDistributed += shares[0];
} else {
shares[3] += shares[0];
}
}
​
if (shares[1] > 0) raacToken.burn(shares[1]);
if (shares[2] > 0) raacToken.safeTransfer(repairFund, shares[2]);
if (shares[3] > 0) raacToken.safeTransfer(treasury, shares[3]);
}

Impact

Rewards are not dripped, but dumped all at once.
This will promote users to stake and increase their voting power right before rewards are added and then leave the system as soon as possible.

Tools Used

Manual review

Recommendations

Improve on the mechanism by making the actual distribution drip like in order to incentivise users to stay longer.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.