Core Contracts

Summary

The stabilityPool calls the mintRewards function whenever raacToken needs to be minted to a receiver. However, the method used to determine the mint amount is flawed, causing a DoS for stabilityPool when minting raacToken.

Vulnerability Details

The intended use of this function is unclear since it is not called from stabilityPool. Additionally, a logical issue in the function's code prevents it from working as intended.

The code checks if excessTokens >= amount, and if true, sets toMint = 0, meaning no new tokens are minted. Instead, the code is expected to transfer raacToken owned by the minter contract. However, in reality, excessTokens does not accurately represent the raacToken balance owned by the minter contract.
The excessTokens state variable is incremented when new tokens are minted to the stabilityPool inside the tick function.

Here are following issues:

• At line 271, tokens are minted to the stabilityPool, and the excessToken variable is incremented.

• The mintRewards function verifies whether excessToken >= amount, indicating that excessToken is considered owned by the minter contract.

• If tokens are minted directly to the minter contract, only the extra amount is minted if amount > excessToken.

• However, the remaining tokens are not owned by the minter contract, leading to a DoS in safeTransfer.

POC

Add the following test case in RAACMinter.test.js and run with command npx hardhat test:

Output:

Impact

mintRewards Funciton will never work as expected , whenever it got integrated in stablityPool

Tools Used

Manual Review

Recommendations

Due to unclear documentation and the function not being integrated into the current stability pool version, a definitive fix cannot be provided. However, the correct approach would be to mint tokens directly to the receiver address without any checks.