Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`StabilityPool.sol::withdraw()` is letting user to claim excess RAAC rewards.

orangesantra

Summary

The withdraw function is as follow -

function withdraw(uint256 deCRVUSDAmount) external nonReentrant whenNotPaused validAmount(deCRVUSDAmount) {
// @audit - why RAAC tokens minted here, if it's already minted inside deposite function ?
// If high number of Raacs is being minted (more than necessaity) the it will benifit user, because raac rewards is
// calculated as - return (totalRewards * userDeposit) / totalDeposits;
@-> _update();
​
if (deToken.balanceOf(msg.sender) < deCRVUSDAmount) revert InsufficientBalance();
​
uint256 rcrvUSDAmount = calculateRcrvUSDAmount(deCRVUSDAmount);
@-> uint256 raacRewards = calculateRaacRewards(msg.sender);
​
if (userDeposits[msg.sender] < rcrvUSDAmount) revert InsufficientBalance();
userDeposits[msg.sender] -= rcrvUSDAmount;
​
if (userDeposits[msg.sender] == 0) {
delete userDeposits[msg.sender];
}
deToken.burn(msg.sender, deCRVUSDAmount);
rToken.safeTransfer(msg.sender, rcrvUSDAmount);
if (raacRewards > 0) {
raacToken.safeTransfer(msg.sender, raacRewards);
}
​
emit Withdraw(msg.sender, rcrvUSDAmount, deCRVUSDAmount, raacRewards);
}

moreover _update(), calls _mintRAACRewards(), which in turn mints RAAC tokens to stability pool, which shouldn't be done.

Vulnerability Details

  • Whenever user deposits RTokens in StabilityPool.sol, _update() is called too, means RAAC gets minted to stability pool.

  • These RAACs will be used to pay raac rewards; when user withdraws from stability pool.

  • But in current implementation additional RAACs is being minted to stability pool, when withdraw function is hit.

  • which is unnecessary, as this part is already done in deposit function.

Why it's problematic ?

  1. when user hits withdraw function, the raac reward for user is calculated via -

uint256 raacRewards = calculateRaacRewards(msg.sender);
function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
uint256 totalDeposits = deToken.totalSupply();
​
uint256 totalRewards = raacToken.balanceOf(address(this));
if (totalDeposits < 1e6) return 0;
​
@-> return (totalRewards * userDeposit) / totalDeposits;
}

  1. As we can see, the return value is directly proportional to totalRewards (raac balance of stabilty pool).

  2. so, user reward will be high if raac balance of stability pool is high.

Impact

User is getting more raac rewards than requirement.

Tools Used

Manual

Recommendations

If it's withdraw function no need to mint additional raacs to stability pool.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.