Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Redundant reward minting call in StabilityPool's deposit function

shui

Summary

The deposit function in StabilityPool.sol makes two identical calls to _mintRAACRewards() in the same transaction, leading to unnecessary gas costs and duplicate computations.

Vulnerability Details

function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update(); // First call to _mintRAACRewards() through _update()
rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
deToken.mint(msg.sender, deCRVUSDAmount);
userDeposits[msg.sender] += amount;
_mintRAACRewards(); // Second redundant call
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}
​
function _update() internal {
_mintRAACRewards(); // First call
}
​
function _mintRAACRewards() internal {
if (address(raacMinter) != address(0)) {
raacMinter.tick(); // Updates emission rate based on block number
}
}

The _mintRAACRewards() function is called twice:

  1. First through _update()

  2. Then directly at the end of the deposit function

Each call triggers raacMinter.tick() which updates emission rates based on block numbers, making the second call unnecessary.

Impact

Low. The redundant call:

  • Wastes gas by making an extra external call

  • Could potentially lead to incorrect emission rate calculations since the updates are based on block numbers

Recommended Mitigation

Remove the redundant call to _mintRAACRewards() at the end of the deposit function since it's already called via _update():

function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update(); // This already calls _mintRAACRewards()
rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
deToken.mint(msg.sender, deCRVUSDAmount);
userDeposits[msg.sender] += amount;
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!