Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

User can exploit the pending rewards on FeeCollector

0xekkoo

Summary

User can claim unearned rewards by acquiring veRAAC tokens just before claiming, as reward calculation doesn't consider token holding duration.

Vulnerability Details

In the FeeCollector contract, the _calculatePendingRewards function calculates rewards based only on current voting power without considering the duration of veRAAC token ownership.

function _calculatePendingRewards(address user) internal view returns (uint256) {
uint256 userVotingPower = veRAACToken.getVotingPower(user);
if (userVotingPower == 0) return 0;
​
uint256 totalVotingPower = veRAACToken.getTotalVotingPower();
if (totalVotingPower == 0) return 0;
uint256 share = (totalDistributed * userVotingPower) / totalVotingPower; // @audit share calculation does not account for the time the user has had the veRAAC token
return share > userRewards[user] ? share - userRewards[user] : 0;
}

Attack Scenario:

  1. Attacker acquires 500 veRAAC right before claiming

  2. New total voting power = 1500 veRAAC (1000 + 500)

  3. Attacker's share calculation:
    share = (1000 500) / 1500 = 333.33 RAAC

  4. Attacker gets 333.33 RAAC despite just acquiring veRAAC

Impact

Attackers can exploit reward distribution by acquiring veRAAC tokens just before claiming to receive unearned rewards, leading to dilution of legitimate long-term holders' reward.

Tools Used

Manual Review

Recommendations

Implement time-weighted rewards or track historical voting power.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.