Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

There are no manager distributions

pyro

Summary

There are no manager distributions

Vulnerability Details

The stability pool handles some manager allocation login in the beginning

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/StabilityPool/StabilityPool.sol#L119

function addManager(address manager, uint256 allocation) external onlyOwner validAmount(allocation) {
if (managers[manager]) revert ManagerAlreadyExists();
managers[manager] = true;
managerAllocation[manager] = allocation;
totalAllocation += allocation;
managerList.push(manager);
emit ManagerAdded(manager, allocation);
}
​
function removeManager(address manager) external onlyOwner {
if (!managers[manager]) revert ManagerNotFound();
totalAllocation -= managerAllocation[manager];
delete managerAllocation[manager];
managers[manager] = false;
_removeManagerFromList(manager);
emit ManagerRemoved(manager);
}
​
function updateAllocation(address manager, uint256 newAllocation) external onlyOwner validAmount(newAllocation) {
if (!managers[manager]) revert ManagerNotFound();
totalAllocation = totalAllocation - managerAllocation[manager] + newAllocation;
managerAllocation[manager] = newAllocation;
emit AllocationUpdated(manager, newAllocation);
}

But inside the manager distribution function it lacks to implement any distributions as the code is not yet finished.

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/StabilityPool/StabilityPool.sol#L326

function depositRAACFromPool(uint256 amount) external onlyLiquidityPool validAmount(amount) {
uint256 preBalance = raacToken.balanceOf(address(this));
​
raacToken.safeTransferFrom(msg.sender, address(this), amount);
​
uint256 postBalance = raacToken.balanceOf(address(this));
if (postBalance != preBalance + amount) revert InvalidTransfer();
​
//@audit Missing manager allocation distribution
// TODO: Logic for distributing to managers based on allocation
​
emit RAACDepositedFromPool(msg.sender, amount);
}

Impact

There are no manager distribution
Code is not finished

Tools Used

Manual review

Recommendations

Finish the function and implement it well.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!