Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

User will always get 0 reward on calling `FeeCollector.sol::claimRewards`.

orangesantra

Summary

The claimRewards() function is as follow -

function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) {
if (user == address(0)) revert InvalidAddress();
uint256 pendingReward = _calculatePendingRewards(user);
if (pendingReward == 0) revert InsufficientBalance();
// Reset user rewards before transfer
@-> userRewards[user] = totalDistributed;
// Transfer rewards
raacToken.safeTransfer(user, pendingReward);
emit RewardClaimed(user, pendingReward);
return pendingReward;
}

_calculatePendingRewards(user) ->

function _calculatePendingRewards(address user) internal view returns (uint256) {
uint256 userVotingPower = veRAACToken.getVotingPower(user);
if (userVotingPower == 0) return 0;
​
uint256 totalVotingPower = veRAACToken.getTotalVotingPower();
if (totalVotingPower == 0) return 0;
uint256 share = (totalDistributed * userVotingPower) / totalVotingPower;
return share > userRewards[user] ? share - userRewards[user] : 0;
}

  1. userRewards[user] is wrongly updated to totalDistributed instead it should not updated to pendingReward
    this will cause user reward to always get stuck as -
    totalDistributed will always be greater than (totalDistributed * userVotingPower) / totalVotingPower;.

  2. so, userRewards[user] > share will be the case everytime; in other words else condition i.e. share = 0 will always
    executed.

Vulnerability Details

  1. Whenever user will call claimRewards() he will recive 0 reward.

  2. The reason is incorrect updation of userRewards[user] to totalDistributed instead of pendingReward

  3. totalDistributed has totally different purpose, and it's used to track historical distribution of reward to all users.

Impact

User will always recive 0 rewards.

Tools Used

Eye

Recommendations

- userRewards[user] = totalDistributed;
+ userRewards[user] = pendingReward;
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::claimRewards sets `userRewards[user]` to `totalDistributed` seriously grieving users from rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!