Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Re-org vulnerability leading to incorrect emission calculations and potential double minting.

pavankv

Summary

Function tick is used to calculate the emission rate if interval passed adn raacToken will get minted based on the block passed since last-update this may lead to double minting.

Vulnerability Details

Function tick() we can see below code snippet

Interval time is determined by blockTimestamp and delta block number is used to mint the raacToken. What if in the current block.number re-org happens.

Take a scenario

  1. Calls tick() at at block 100, minting tokens.

  2. tick() updates lastUpdateBlock = 100.

  3. 10 blocks pass, emission rate = 100 RAAC per block.

  4. **Minted **10 * 100 = 1000 RAAC.

  5. Blockchain re-orgs back to block 98, invalidating block 100.

  6. Contract still believes lastUpdateBlock = 100, while the chain is at 98.

  7. Waits until the chain reaches 100 again and calls tick().

  8. tick() recalculates from lastUpdateBlock = 100, even though it was already executed.

  9. Another 1000 RAAC is minted, even though the total blocks haven't increased.

/**
* @dev Triggers the minting process and updates the emission rate if the interval has passed
*/
function tick() external nonReentrant whenNotPaused {
if (emissionUpdateInterval == 0 || block.timestamp >= lastEmissionUpdateTimestamp + emissionUpdateInterval) {
updateEmissionRate();
}
uint256 currentBlock = block.number;
uint256 blocksSinceLastUpdate = currentBlock - lastUpdateBlock;
if (blocksSinceLastUpdate > 0) {
uint256 amountToMint = emissionRate * blocksSinceLastUpdate;
​
if (amountToMint > 0) {
excessTokens += amountToMint;
lastUpdateBlock = currentBlock;
raacToken.mint(address(stabilityPool), amountToMint);
emit RAACMinted(amountToMint);
}
}
}

POC

Impact

Miniting will be taken two times

Tools Used

Manual View

Recommendations

Use BlockTimestamp instead of block.number.

Use check points that current block number is to be higer than the stored block number

require(block.number > lastUpdateBlock, "Possible re-org detected");

Code Snippet

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/minters/RAACMinter/RAACMinter.sol#L256

Updates

Lead Judging Commences

inallhonesty Lead Judge
9 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!