Core Contracts

Summary

The FeeCollector contract contains a critical flaw where rewards allocated to veRAAC token holders become permanently unclaimable if the total voting power (totalVeRAACSupply) ever drops to zero. This occurs because reward calculations depend on a non-zero totalVeRAACSupply, and the contract lacks safeguards to handle this edge case. As a result, all RAAC tokens in the totalDistributed pool are effectively lost, rendering the protocol’s reward mechanism unreliable.

Vulnerability Details

FeeCollector Contract – _calculatePendingRewards Function:

Root Cause

• Dynamic totalVeRAACSupply Dependency: The totalDistributed variable accumulates rewards allocated to veRAAC holders, but reward claims require a non-zero totalVotingPower to calculate user shares.

• No Recovery Mechanism: If totalVeRAACSupply drops to zero (e.g., all veRAAC tokens are unstaked or burned), the totalDistributed pool becomes inaccessible, as the calculation (totalDistributed * userVotingPower) / totalVotingPower reverts to zero.

Scenario Example

1. Initial Distribution:

   • totalVeRAACSupply = 1000

   • totalDistributed = 5000 RAAC (allocated to veRAAC holders).

2. Users Unstake All veRAAC Tokens:

   • totalVeRAACSupply = 0.

3. Reward Claims Attempted:

   • _calculatePendingRewards returns 0 for all users due to division by zero.

   • Result: 5000 RAAC tokens are permanently locked in the contract.

Impact

All RAAC tokens in totalDistributed become unclaimable if totalVeRAACSupply reaches zero.

Tools Used

Manual Review +

Recommendations

Store snapshots of totalVeRAACSupply during each distribution to enable accurate reward calculations