Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Reward Calculation in `claimRewards` Function

mahdikarimi

Summary

The claimRewards function in the FeeCollector contract incorrectly updates the userRewards[user] mapping by setting it to totalDistributed instead of properly accounting for the rewards already claimed by the user. This leads to an incorrect calculation of pending rewards and potential loss of user rewards.

Description

The claimRewards function is responsible for distributing accumulated rewards to users based on their voting power. However, it incorrectly sets userRewards[user] = totalDistributed instead of adding the pendingReward amount to userRewards[user]. This results in an inaccurate update of user rewards, potentially preventing users from receiving their full reward in the future.

Code Snippet

function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) {
if (user == address(0)) revert InvalidAddress();
uint256 pendingReward = _calculatePendingRewards(user);
if (pendingReward == 0) revert InsufficientBalance();
// @audit it should be set to user claimed share not totalDistributed
// Reset user rewards before transfer
userRewards[user] = totalDistributed; // Incorrect logic
// Transfer rewards
raacToken.safeTransfer(user, pendingReward);
emit RewardClaimed(user, pendingReward);
return pendingReward;
}

Suggested Fix

Modify the claimRewards function as follows:

// Correct user reward update
userRewards[user] += pendingReward;

Impact

  • Users receive fewer rewards than they are entitled to in the future.

  • Some rewards may become unclaimable due to incorrect tracking of claimed amounts.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::claimRewards sets `userRewards[user]` to `totalDistributed` seriously grieving users from rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!