Core Contracts

Summary

The rewardsUpdate function does not verify whether the caller has a veRAACToken balance. Instead, it simply returns minBoost, which could allow an attacker to claim rewards without staking or holding veRAACToken.

Vulnerability Details

When a user calls the getRewards function, the updateRewards modifier is executed first. The reward update process follows these steps:

1. Inside _updateReward, the contract retrieves rewardsPerToken and lastUpdateTime.

2. The earned function is called for the user to calculate the rewards.

This sequence ensures that the reward calculations are up to date before the user claims rewards.

The earned function determines a user's reward amount by:

• Calling getUserWeight to retrieve the user's weight.

• Multiplying the weight by the percentage of rewards changed.

• Adding the result to the user's current rewards balance.
  This process ensures that rewards are distributed proportionally based on user weight.

The getUserWeight function retrieves the weight of a gauge and applies the appropriate boost to the specified user.

The _applyBoost function determines the user's boost based on:

1. The current total supply.

2. The user's individual balance.

As shown in the calculateBoost function, it will always return minBoost, even if the user's balance is 0.

All the details mentioned above lead to an issue where users can still claim rewards even when their balance is 0.

POC

The following POC will proof the attack vector , Please add it inside RAACGaufe.test.js file and run with command npx hardhat test:

Logs :

Impact

An attacker can claim reward tokens without holding any veRAACToken, which reduces the claimable amount for legitimate users and allows the attacker to receive free rewards.

Tools Used

Manual Review

Recommendations

One potentail fix could be calculateBoost funciton check if user balance is 0 the return 0.