Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing manager reward distribution leads to incorrect `RAAC` allocation

falendar

Summary

RAAC tokens deposited through the depositRAACFromPool function in the StabilityPool contract, which are intended for manager rewards, incorrectly become part of the general reward pool and can be claimed by regular users due to unimplemented manager distribution logic.

Vulnerability Details

RAAC tokens from the liquidity pool are meant to be distributed to managers based on their allocations:

mapping(address => bool) public managers;
mapping(address => uint256) public managerAllocation;
uint256 public totalAllocation;
function depositRAACFromPool(uint256 amount) external onlyLiquidityPool validAmount(amount) {
uint256 preBalance = raacToken.balanceOf(address(this));
​
raacToken.safeTransferFrom(msg.sender, address(this), amount);
​
uint256 postBalance = raacToken.balanceOf(address(this));
if (postBalance != preBalance + amount) revert InvalidTransfer();
​
// TODO: Logic for distributing to managers based on allocation
​
emit RAACDepositedFromPool(msg.sender, amount);
}

However, these tokens are added to the StabilityPool's RAAC balance and become claimable by regular users through the reward calculation:

function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
uint256 totalDeposits = deToken.totalSupply();
​
uint256 totalRewards = raacToken.balanceOf(address(this));
if (totalDeposits < 1e6) return 0;
​
return (totalRewards * userDeposit) / totalDeposits;
}

Impact

High: RAAC tokens intended for manager rewards are incorrectly distributed to regular users. This breaks the intended incentive mechanism for managers and could lead to loss of manager rewards.

Recommendations

Consider separating manager rewards from user rewards by using a dedicated manager reward tracking system.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!