Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Diluted Manager Allocation

ChainDefenders

Summary

In the StabilityPool.sol contract the totalAllocation variable is used for both managers and markets, which dilutes the allocation for managers when calculating their shares.

Vulnerability Details

The vulnerability arises from the use of a single totalAllocation variable to represent the combined allocation for both managers and markets. This approach dilutes the allocation for managers when calculating their shares, as the total allocation includes both manager and market allocations. According to the comment above the getTotalAllocation function, totalAllocation should only contain the allocation across all managers.

Impact

By diluting the allocation for managers, the protocol may incorrectly distribute rewards and resources, leading to unfair compensation for managers. This can result in reduced incentives for managers to participate and perform their roles effectively. Over time, this can undermine the stability and efficiency of the protocol, as managers may be less motivated to contribute.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, separate the allocation tracking for managers and markets. Introduce a new variable, totalMarketAllocation, to track the total allocation for markets. Update the relevant functions to use the correct allocation variables. Here is an example of how to implement this:

uint256 public totalManagerAllocation;
uint256 public totalMarketAllocation;
​
// Update functions to use separate allocation variables
function addManager(address manager, uint256 allocation) external onlyOwner validAmount(allocation) {
if (managers[manager]) revert ManagerAlreadyExists();
managers[manager] = true;
managerAllocation[manager] = allocation;
totalManagerAllocation += allocation;
managerList.push(manager);
emit ManagerAdded(manager, allocation);
}
​
function removeManager(address manager) external onlyOwner {
if (!managers[manager]) revert ManagerNotFound();
totalManagerAllocation -= managerAllocation[manager];
delete managerAllocation[manager];
managers[manager] = false;
_removeManagerFromList(manager);
emit ManagerRemoved(manager);
}
​
function updateAllocation(address manager, uint256 newAllocation) external onlyOwner validAmount(newAllocation) {
if (!managers[manager]) revert ManagerNotFound();
totalManagerAllocation = totalManagerAllocation - managerAllocation[manager] + newAllocation;
managerAllocation[manager] = newAllocation;
emit AllocationUpdated(manager, newAllocation);
}
​
function addMarket(address market, uint256 allocation) external onlyOwner validAmount(allocation) {
if (supportedMarkets[market]) revert MarketAlreadyExists();
supportedMarkets[market] = true;
marketAllocations[market] = allocation;
totalMarketAllocation += allocation;
emit MarketAdded(market, allocation);
}
​
function removeMarket(address market) external onlyOwner {
if (!supportedMarkets[market]) revert MarketNotFound();
supportedMarkets[market] = false;
totalMarketAllocation -= marketAllocations[market];
delete marketAllocations[market];
emit MarketRemoved(market);
}
​
function updateMarketAllocation(address market, uint256 newAllocation) external onlyOwner validAmount(newAllocation) {
if (!supportedMarkets[market]) revert MarketNotFound();
totalMarketAllocation = totalMarketAllocation - marketAllocations[market] + newAllocation;
marketAllocations[market] = newAllocation;
emit MarketAllocationUpdated(market, newAllocation);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!