Submission Details
Severity:
There are no manager distributions
Summary
There are no manager distributions
Vulnerability Details
The stability pool handles some manager allocation login in the beginning
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/StabilityPool/StabilityPool.sol#L119
function addManager(address manager, uint256 allocation) external onlyOwner validAmount(allocation) {
if (managers[manager]) revert ManagerAlreadyExists();
managers[manager] = true;
managerAllocation[manager] = allocation;
totalAllocation += allocation;
managerList.push(manager);
emit ManagerAdded(manager, allocation);
}
function removeManager(address manager) external onlyOwner {
if (!managers[manager]) revert ManagerNotFound();
totalAllocation -= managerAllocation[manager];
delete managerAllocation[manager];
managers[manager] = false;
_removeManagerFromList(manager);
emit ManagerRemoved(manager);
}
function updateAllocation(address manager, uint256 newAllocation) external onlyOwner validAmount(newAllocation) {
if (!managers[manager]) revert ManagerNotFound();
totalAllocation = totalAllocation - managerAllocation[manager] + newAllocation;
managerAllocation[manager] = newAllocation;
emit AllocationUpdated(manager, newAllocation);
}
But inside the manager distribution function it lacks to implement any distributions as the code is not yet finished.
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/StabilityPool/StabilityPool.sol#L326
function depositRAACFromPool(uint256 amount) external onlyLiquidityPool validAmount(amount) {
uint256 preBalance = raacToken.balanceOf(address(this));
raacToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 postBalance = raacToken.balanceOf(address(this));
if (postBalance != preBalance + amount) revert InvalidTransfer();
//@audit Missing manager allocation distribution
// TODO: Logic for distributing to managers based on allocation
emit RAACDepositedFromPool(msg.sender, amount);
}
Impact
There are no manager distribution
Code is not finished
Tools Used
Manual review
Recommendations
Finish the function and implement it well.
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.