Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

FeeCollector Contract's claimRewards Function Issue

01chenqing

Summary

The claimRewards function in the FeeCollector contract contains a critical flaw where it sets the userRewards[user] to totalDistributed instead of incrementing it by the pendingReward amount. This incorrect assignment can lead to scenarios where users experience asset losses when they attempt to claim rewards a second time, as their rewards are improperly tracked

Vulnerability Details

When a user claims rewards, the function resets their userRewards to the total amount distributed rather than accumulating the newly claimed rewards. This can result in userRewards[user] reflecting a value that is greater than what the user has actually earned.

/**
* @notice Claims accumulated rewards for a user
* @param user Address of the user claiming rewards
* @return amount Amount of rewards claimed
*/
function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) {
if (user == address(0)) revert InvalidAddress();
uint256 pendingReward = _calculatePendingRewards(user);
if (pendingReward == 0) revert InsufficientBalance();
// Reset user rewards before transfer
userRewards[user] = totalDistributed; // Incorrect assignment here
// Transfer rewards
raacToken.safeTransfer(user, pendingReward);
emit RewardClaimed(user, pendingReward);
return pendingReward;
}

Impact

The impact of this vulnerability is significant, as it may lead to users not receiving the correct rewards they are entitled to, causing economic loss and undermining user trust in the contract.

Recommendations

Modify the implementation to accumulate pending rewards correctly, ensuring accurate tracking of user rewards.

function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) {
if (user == address(0)) revert InvalidAddress();
uint256 pendingReward = _calculatePendingRewards(user);
if (pendingReward == 0) revert InsufficientBalance();
// Accumulate user rewards correctly
userRewards[user] += pendingReward;
// Transfer rewards
raacToken.safeTransfer(user, pendingReward);
emit RewardClaimed(user, pendingReward);
return pendingReward;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::claimRewards sets `userRewards[user]` to `totalDistributed` seriously grieving users from rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!