Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

`StabilityPool::calculateRaacRewards` using mismatched token bases causes system loss of funds

kiteweb3

Summary

The StabilityPool::calculateRaacRewards calculates rewards using mismatched token bases. The contract incorrectly mixes userDeposits[user] that represents the user rToken deposit amounts with deToken.totalSupply values that represents the total supply of deToken. These values are used directly in a division without accounting for their different bases. This leads users to receive significantly more or fewer rewards than intended, depending on decimal differences.

Vulnerability Details

function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
@> uint256 totalDeposits = deToken.totalSupply();
​
uint256 totalRewards = raacToken.balanceOf(address(this));
if (totalDeposits < 1e6) return 0;
​
return (totalRewards * userDeposit) / totalDeposits;
}

Impact

Consider this scenario:

  • User A deposits 100 rToken (18 decimals) -> gets 100 deToken (6 decimals)

  • userDeposits[A] = 100 * 1e18

  • deToken.totalSupply() = 100 * 1e6

Reward Calculation:

  • totalRewards = 1000 RAAC

  • User A rewards = (1000 * (100 * 1e18)) / (100 * 1e6) = 1000 * 1e12 RAAC

  • User gets 1000x more rewards than intended

Users can receive significantly more or fewer rewards than intended, depending on decimal differences. Early depositors could drain the reward pool by receiving outsized rewards.

Tools Used

Manual review

Recommendations

Use the same token base (rToken) for both the numerator and denominator.

function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
- uint256 totalDeposits = deToken.totalSupply();
+ uint256 totalDeposits = rToken.balanceOf(address(this));
​
uint256 totalRewards = raacToken.balanceOf(address(this));
if (totalDeposits < 1e6) return 0;
​
return (totalRewards * userDeposit) / totalDeposits;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!