Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

[M-3] Incorrect Reward Tracking in `FeeCollector::claimRewards`

player

Description:
The FeeCollector::claimRewards function is designed to allow users to claim their accumulated rewards. It calculates the pending reward amount for the given user and transfers it to them. However, instead of updating userRewards[user] with the actual claimed pendingReward, the function mistakenly assigns totalDistributed to userRewards[user].

Since totalDistributed is incremented by shares[0] (representing the total fees distributed to veRAAC holders), this incorrect assignment leads to inaccurate tracking of individual user rewards. The function should instead update userRewards[user] with the exact amount the user has claimed.

Impact:
This miscalculation results in an incorrect accounting of user rewards. Instead of accurately reflecting the rewards claimed by a user, userRewards[user] will store the total distributed fees across the protocol. This could cause issues in reward tracking, leading to inconsistencies in future reward claims and potential over- or under-distribution of rewards.

Proof of Concept:

function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) {
if (user == address(0)) revert InvalidAddress(); // Validate user address
​
uint256 pendingReward = _calculatePendingRewards(user); // Calculate user's pending reward
if (pendingReward == 0) revert InsufficientBalance(); // Ensure the user has a claimable balance
​
// Incorrectly assigns totalDistributed instead of the actual pending reward
userRewards[user] = totalDistributed;
​
// Transfer the pending reward to the user
raacToken.safeTransfer(user, pendingReward);
​
emit RewardClaimed(user, pendingReward);
return pendingReward;
}

Recommended Mitigation:
Replace the incorrect assignment with the correct logic to store the actual claimed reward amount in userRewards[user]:

- userRewards[user] = totalDistributed;
+ userRewards[user] = pendingReward;

This change ensures that userRewards[user] properly reflects the amount of rewards claimed by the user, maintaining accurate reward distribution tracking.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::claimRewards sets `userRewards[user]` to `totalDistributed` seriously grieving users from rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.