Submission Details
Severity:
stabilityPool.deposit calls _mintRAACRewards twice but incorrectly
Within stabilityPool.deposit it attempts to mint RAAC rewards to the contract following users deposit but does so incorrectly
function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
@> _update();
rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
deToken.mint(msg.sender, deCRVUSDAmount);
userDeposits[msg.sender] += amount;
@> _mintRAACRewards();//@audit-info this should be raacMinter.mintRewards(address(this), amount)
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}
The issue is that on the second call to _mintRAACRewards the function does not mint the reward to the contract but rather it does the same as _update() which serves as a notifier.
Impact
RAAACRewards would not be minted at deposit leading to erroneous state.
Recommendation
Consider the following changes
function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update();
rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
deToken.mint(msg.sender, deCRVUSDAmount);
userDeposits[msg.sender] += amount;
- _mintRAACRewards();
+ raacMinter.mintRewards(address(this), amount);//@audit-info ensure the minted amount is accurate
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RAACMinter::mintRewards function is never called by StabilityPool despite being the only authorized caller, leaving intended reward functionality unused
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RAACMinter::mintRewards function is never called by StabilityPool despite being the only authorized caller, leaving intended reward functionality unused
Appeal created
kodyvim
7 months ago
inallhonesty
7 months ago
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
RAACMinter::mintRewards function is never called by StabilityPool despite being the only authorized caller, leaving intended reward functionality unused
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.