Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

The depositRAACFromPool function does not distribute tokens to managers based on their allocations

biakia

Summary

The depositRAACFromPool function in the StabilityPool contract is designed to allow the LiquidityPool to deposit RAAC tokens into the StabilityPool. However, the function contains a TODO comment indicating that the logic for distributing these tokens to managers based on their allocations is incomplete, leading to potential loss of assets and inefficiency in the system.

Vulnerability Details

The depositRAACFromPool function only transfers RAAC tokens from the LiquidityPool to the StabilityPool but does not implement the logic to distribute these tokens to managers based on their allocations:

/**
* @notice Deposits RAAC tokens from the liquidity pool.
* @param amount Amount of RAAC tokens to deposit.
*/
function depositRAACFromPool(uint256 amount) external onlyLiquidityPool validAmount(amount) {
uint256 preBalance = raacToken.balanceOf(address(this));
​
raacToken.safeTransferFrom(msg.sender, address(this), amount);
​
uint256 postBalance = raacToken.balanceOf(address(this));
if (postBalance != preBalance + amount) revert InvalidTransfer();
​
// TODO: Logic for distributing to managers based on allocation
​
emit RAACDepositedFromPool(msg.sender, amount);
}

The intended functionality of distributing tokens to managers based on their allocations is not implemented, leading to inefficiency in the system.

Impact

The impact is Low, the likelihood is High, so the severity is Low.

Tools Used

Manual Review

Recommendations

To address this issue, the depositRAACFromPool function should be updated to include the logic for distributing RAAC tokens to managers based on their allocations.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!