Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Same tokens can be used to claim rewards more than one time in `FeeCollector`

ke1caM

Summary

The FeeCollector contract implements rewards calculation mechanism which takes into consideration user's current voting power and total voting power. User can use his tokens, to claim rewards multiple times, using multiple addresses.

Vulnerability Details

The claimRewards function calls _calculatePendingRewards to calculate rewards for users.

function _calculatePendingRewards(address user) internal view returns (uint256) {
uint256 userVotingPower = veRAACToken.getVotingPower(user);
if (userVotingPower == 0) return 0;
​
uint256 totalVotingPower = veRAACToken.getTotalVotingPower();
if (totalVotingPower == 0) return 0;
uint256 share = (totalDistributed * userVotingPower) / totalVotingPower;
return share > userRewards[user] ? share - userRewards[user] : 0;
}

This function uses user's current voting power and total voting power to calculate rewards for user.

To exploit this function user has to:

  1. Create lock (locking his tokens) to get voting power.

  2. Claim rewards.

  3. After the lock expires, send his tokens to other address and create another lock using new address.

  4. Now, using new address the userRewards are equal to zero and user can claim rewards again.

Impact

User can use his tokens to claim rewards multiple times claiming more than users who use only one address.

Tools Used

Manual Review, Hardhat

Recommendations

Fix rewards calculation so that user is not able to claim rewards multiple times using different addresses and same tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.