Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

broken formula at MarketCreator wrongly calculate reward

moray5554

Summary

Rewards for market suppose to be fixed and proportionaly distributed according to users deposits, meanwhile curent implementation leads to draining of rewards from contract.

Vulnerability Details

MarketCreator.sol calculateReward()

function calculateReward(uint256 marketId, uint256 amount) internal view returns (uint256) {
​
Market storage market = markets\[marketId];
​
return (amount \* market.reward) / market.totalDeposits;
​
}

Because reward not decreased after each withdrawal user's will drain whole contract's token balance (assumed we launcg few markets within the contract).
Another problem which causing such formula is that last user who receiving rewards will take whole amount of rewars. Because if it is only his funds at pool, reward at 100% will be granted to him

Impact

drain of protocol reward

Tools Used

Recommendations

decrease reward when some withdraw from market

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!