Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

RAACMinter Minting Insufficient Funds

aariiif

Summary

The RAACMinter's mintRewards() function has a critical arithmetic flaw where it mints (amount - excessTokens) but transfers the full amount, leading to insufficient funds when excessTokens is less than amount.

Vulnerability Details

mintRewards mints toMint = amount - excessTokens but transfers amount, risking underflow if excessTokens < amount.

In RAACMinter.sol#mintRewards

function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {
if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();
uint256 toMint = excessTokens >= amount ? 0 : amount - excessTokens;
excessTokens = excessTokens >= amount ? excessTokens - amount : 0;
​
if (toMint > 0) {
raacToken.mint(address(this), toMint); // Mints less than amount
}
raacToken.safeTransfer(to, amount); // Transfers full amount
}

Looking at this attack Path:

  1. StabilityPool requests reward mint of 1000 tokens

  2. excessTokens = 400

  3. Contract mints only 600 (1000 - 400)

  4. Attempts to transfer 1000

  5. Transfer fails due to insufficient balance

Impact

Transfers may fail, locking rewards.

Tools Used

manual

Recommendations

Adjust logic to mint amount directly or ensure sufficient excessTokens.

We can implement either of these solutions to fix the RAACMinter's reward distribution logic

  • Direct Minting Approach

function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {
if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();
// Mint full amount directly
raacToken.mint(address(this), amount);
raacToken.safeTransfer(to, amount);
}

  • ExcessTokens Balance Check

function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {
if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();
uint256 currentBalance = raacToken.balanceOf(address(this));
if (currentBalance < amount) {
uint256 toMint = amount - currentBalance;
raacToken.mint(address(this), toMint);
}
raacToken.safeTransfer(to, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Too generic

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.