Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Excess Tokens Mismanagement in RAACMinter Contract

aksoy

Summary

The RAACMinter contract's mintRewards function incorrectly assumes that excess tokens are retained within the minter contract. However, all tokens are minted directly to the StabilityPool, leaving no tokens in the contract itself. This results in the mintRewards function potentially failing when attempting to transfer tokens that are not present in the contract.

Vulnerability Details

The excessTokens variable is intended to track tokens that remain in the minter contract after emissions. However, the tick function mints all calculated tokens directly to the StabilityPool, leaving no tokens in the minter contract. When mintRewards is called and excessTokens is bigger than 0 , it attempts to use excess tokens and mint the rest. Since the tokens are not actually present in the contract, this operation can fail, leading to a revert.

function tick() external nonReentrant whenNotPaused {
if (emissionUpdateInterval == 0 || block.timestamp >= lastEmissionUpdateTimestamp + emissionUpdateInterval) {
updateEmissionRate();
}
uint256 currentBlock = block.number;
uint256 blocksSinceLastUpdate = currentBlock - lastUpdateBlock;
if (blocksSinceLastUpdate > 0) {
uint256 amountToMint = emissionRate * blocksSinceLastUpdate;
​
if (amountToMint > 0) {
excessTokens += amountToMint;
lastUpdateBlock = currentBlock;
raacToken.mint(address(stabilityPool), amountToMint);
emit RAACMinted(amountToMint);
}
}
}
​
function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {
if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();
uint256 toMint = excessTokens >= amount ? 0 : amount - excessTokens;
excessTokens = excessTokens >= amount ? excessTokens - amount : 0;
​
if (toMint > 0) {
raacToken.mint(address(this), toMint);
}
raacToken.safeTransfer(to, amount);
emit RAACMinted(amount);
}

Impact

The mintRewards function may fail, preventing the distribution of rewards and disrupting the protocol's reward mechanism.

Tools Used

Manual

Recommendations

Adjust the logic to ensure that excessTokens accurately reflects the tokens available within the minter contract. Consider minting tokens to the minter contract first and then transferring them to the StabilityPool as needed.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter wrong excessTokens accounting in tick function

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter wrong excessTokens accounting in tick function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.