Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

veRAACToken holders can claim rewards fewer than expected in FeeCollector

newspacexyz

Summary

veRAACToken holders can claim rewards fewer than expected in FeeCollector.

Vulnerability Details

veRAACToken holders claim rewards by FeeCollector#claimRewards()and actual rewards are calculated in _calculatePendingRewards().

function _calculatePendingRewards(address user) internal view returns (uint256) {
uint256 userVotingPower = veRAACToken.getVotingPower(user);
if (userVotingPower == 0) return 0;
​
uint256 totalVotingPower = veRAACToken.getTotalVotingPower();
if (totalVotingPower == 0) return 0;
@> uint256 share = (totalDistributed * userVotingPower) / totalVotingPower;
return share > userRewards[user] ? share - userRewards[user] : 0;
}

As seen above, shares are merely depends on owning veRAACTokens.

This results in newly locked users unfairly benefiting from the rewards pool, while older users receive fewer rewards than expected. This issue arises once when newly locked users exist, and the reason is that totalDistributed is updated before user rewards are calculated, allowing new users to manipulate the system by locking tokens at the right time.

Impact

A user can lock tokens right after a distribution event, gaining instant access to rewards they did not contribute to. This dilutes rewards for long-term veRAACToken holders.

Tools Used

manual

Recommendations

Fix is not trivial.

One approach is that modify the reward calculation to snapshot the total veRAACToken supply before distribution, ensuring only existing holders benefit.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!