Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Excessive Reward Distribution Due to Untracked Partial Withdrawals

waydou

Summary

The StabilityPool's withdrawal mechanism enables users to receive disproportionate RAAC rewards through partial withdrawals, as reward calculations are based on the current deposit amount without tracking previously claimed rewards.

Vulnerability Details

When users perform a partial withdrawal, the reward calculation happens before the user's deposit is reduced, but no tracking of claimed rewards occurs:

function withdraw(uint256 deCRVUSDAmount) external {
// ...
uint256 rcrvUSDAmount = calculateRcrvUSDAmount(deCRVUSDAmount);
uint256 raacRewards = calculateRaacRewards(msg.sender); // Uses current full deposit
userDeposits[msg.sender] -= rcrvUSDAmount; // Reduces deposit AFTER reward calculation
// Transfers rewards without tracking claims
if (raacRewards > 0) {
raacToken.safeTransfer(msg.sender, raacRewards);
}
}
​
function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
uint256 totalDeposits = deToken.totalSupply();
uint256 totalRewards = raacToken.balanceOf(address(this));
return (totalRewards * userDeposit) / totalDeposits;
}

A user can exploit this by:

First withdrawal:

  • Withdraw 10% of deposit
    Get rewards calculated on 100% of deposit

Second withdrawal:

  • Withdraw remaining 90%
    Get additional rewards calculated on 90% of deposit

Impact

This vulnerability allows:

  1. Multiple claims of rewards on the same deposit period

  2. Excessive reward distribution

  3. Unfair advantage for users who perform partial withdrawals

  4. Depletion of protocol rewards

Tools Used

Manual review

Recommendations

Calculate rewards based on the withdrawn amount

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::withdraw can be called with partial amounts, but it always send the full rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!