Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Users can manipulate the utilization in order to increase emissions

pyro

Summary

Users can manipulate the utilization in order to increase emissions

Vulnerability Details

Users can manipulate the utilization by borrowing right before triggering updateEmissionRate and then repaying the borrow. The utilization would be kept high for the whole emissionUpdateInterval, which is currently set to 1 day, this can be performed every time.

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/minters/RAACMinter/RAACMinter.sol#L206

function updateEmissionRate() public whenNotPaused {
if (emissionUpdateInterval > 0 && block.timestamp < lastEmissionUpdateTimestamp + emissionUpdateInterval) {
revert EmissionUpdateTooFrequent();
}
​
// We can jump this utilization just before the update by borrowing assets or smt and then repaying
// in order to keep the interest high for 1 day
​
uint256 newRate = calculateNewEmissionRate();
​
emissionRate = newRate;
lastEmissionUpdateTimestamp = block.timestamp;
emit EmissionRateUpdated(newRate);
}

The main purpose for this can be either to grief other users and/or to increase emissions, as they are increased if the utill is higher than the utilizationTarget.

Impact

Users can manipulate the system to get higher emissions

Tools Used

Manual review

Recommendations

Consider making the utilization floating and avoid setting any fixed balances for days.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter vulnerable to manipulation via flash borrowing to artificially inflate emission rates by temporarily spiking utilization

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter vulnerable to manipulation via flash borrowing to artificially inflate emission rates by temporarily spiking utilization

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.