Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

RAAC Rewards Distribution Vulnerability in StabilityPool

aksoy

Summary

The StabilityPool contract's rewards distribution mechanism allows users to exploit the system by depositing and withdrawing multiple times to drain rewards. The current implementation does not differentiate between long-term and short-term depositors, leading to potential reward manipulation.

Vulnerability Details

The calculateRaacRewards function distributes RAAC rewards based on the user's current deposit relative to the total deposits. This approach does not account for the duration of deposits, allowing new users to earn the same rewards as long-term depositors. Users can repeatedly deposit and withdraw to drain the pool rewards without maintaining a long-term stake in the pool.

function withdraw(uint256 deCRVUSDAmount) external nonReentrant whenNotPaused validAmount(deCRVUSDAmount) {
_update();
if (deToken.balanceOf(msg.sender) < deCRVUSDAmount) revert InsufficientBalance();
​
uint256 rcrvUSDAmount = calculateRcrvUSDAmount(deCRVUSDAmount);
uint256 raacRewards = calculateRaacRewards(msg.sender);
​
if (raacRewards > 0) {
raacToken.safeTransfer(msg.sender, raacRewards);
}
}
​
/**
* @notice Calculates the pending RAAC rewards for a user.
* @param user Address of the user.
* @return Amount of RAAC rewards.
*/
function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
uint256 totalDeposits = deToken.totalSupply();
​
uint256 totalRewards = raacToken.balanceOf(address(this));
if (totalDeposits < 1e6) return 0;
​
return (totalRewards * userDeposit) / totalDeposits;
}

Impact

Long-term depositors receive no additional benefit compared to short-term depositors, leading to potential dissatisfaction and loss of trust.

The RAAC rewards pool can be quickly drained by users exploiting this mechanism, reducing the incentive for future participation.

Tools Used

Manual

Recommendations

Introduce a mechanism to weight rewards based on the duration of deposits. This could involve tracking the deposit time and adjusting rewards accordingly.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards is vulnerable to just in time deposits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.