Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Distribution Cap Check in `getReward`

udo

Summary

The getReward function is responsible for allowing users to claim their accumulated rewards. However, the function does not enforce a check against the distributionCap, potentially allowing excessive reward claims beyond the intended cap.

Vulnerability Details

The getReward function processes user reward claims but does not verify if the total claimed rewards exceed distributionCap. This could lead to scenarios where the reward distribution surpasses the intended limit, potentially depleting contract funds and causing economic instability in the system.

Relevant code snippet:

function getReward() external virtual nonReentrant whenNotPaused updateReward(msg.sender) {
if (block.timestamp - lastClaimTime[msg.sender] < MIN_CLAIM_INTERVAL) {
revert ClaimTooFrequent();
}
​
lastClaimTime[msg.sender] = block.timestamp;
UserState storage state = userStates[msg.sender];
uint256 reward = state.rewards;
​
if (reward > 0) {
state.rewards = 0;
​
uint256 balance = rewardToken.balanceOf(address(this));
if (reward > balance) {
revert InsufficientBalance();
}
​
rewardToken.safeTransfer(msg.sender, reward);
emit RewardPaid(msg.sender, reward);
}
}
​

Impact

  • Users may claim rewards beyond the intended cap.

  • The contract may distribute an excessive amount of rewards, depleting funds faster than planned.

  • Could lead to an economic imbalance within the system.

Tools Used

  • Manual code review

Recommendations

  • Introduce a check against distributionCap before transferring rewards.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge lacks enforcement of both distributionCap and MAX_REWARD_RATE limits

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge lacks enforcement of both distributionCap and MAX_REWARD_RATE limits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!