Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`tick` mints tokens to the wrong address, `mintRewards` won't work

pyro

Summary

tick mints tokens to the wrong address

Vulnerability Details

tick mints tokens directly to out stabilityPool, which is wrong

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/minters/RAACMinter/RAACMinter.sol#L259

function tick() external nonReentrant whenNotPaused {
// ...
​
if (amountToMint > 0) {
// Tokens are minted to the amountToMint
// but they are expected to be here as we trasnfer them inside mintRewards
excessTokens += amountToMint;
lastUpdateBlock = currentBlock;
raacToken.mint(address(stabilityPool), amountToMint);
emit RAACMinted(amountToMint);
}
}
}

That is an issue because mintRewards will not work as it expects those tokens minted in tick to be minted to this contract, which would then send them to the stability pool using mintRewards:

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/minters/RAACMinter/RAACMinter.sol#L181

function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {
if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();
​
uint256 toMint = excessTokens >= amount
? 0
: amount - excessTokens;
​
excessTokens = excessTokens >= amount
? excessTokens - amount
: 0;
​
if (toMint > 0) {
raacToken.mint(address(this), toMint);
}
​
raacToken.safeTransfer(to, amount);
emit RAACMinted(amount);
}

However since RAACMinter won't have those tokens in hand it would mean that mintRewards will not work at all.

Impact

Function will not work properly and would revert

Tools Used

Manual review

Recommendations

Mint tokens to this contract instead.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter wrong excessTokens accounting in tick function

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter wrong excessTokens accounting in tick function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!