Core Contracts

Summary

Whenever users lock in RAACTokens, they receive veRAACTokens, which makes them eligible for RAACToken rewards. These rewards are based on fees collected in the FeeCollector, which are distributed over periods. However, with the current reward calculations, users who have joined after a fee distribution, are immediately eligible for rewards.

Vulnerability Details

If we look at how rewards are calculated, we will see that with every fee distribution totalDistributed increases, meaning that every new user who locks, will immediately have the ability to claim rewards:

Impact

Early RAACToken lockers lose incentive and end up losing rightful rewards.

Tools Used

Manual review.

Recommendations

Create internal mappings in FeeCollector to track when users have locked and set their "earned" rewards to 0, and then update them when new fees are distributed.