Core Contracts

Summary

A malicious user can claim RAAC rewards ealier for other protocol users so as to manipulate the veRAAC yield distribution.

Vulnerability Details

Users accumulate RAAC token rewards when they hold veRAAC over a period of time. However, the claimRewards function in the FeeCollector contract allows for anyone to claim rewards on behalf of a person. This opens room for malicious users to claim on behalf of users holding veRAAC tokens.

POC

• Alice, Bob, and Jack obtained the veRAAC tokens at the same time.

• Bob knows he can claim for Alice and call claimRewards passing Alice address.

• Alice receives her RAAC rewards earlier than she wanted.

• Bob and Jack will have more voting power than Alice and gather more RAAC rewards because they are still holding for long with larger accumulation.

  
  OBSERVE how a user voting power is used to estimate the RAAC rewards accumulated over time.

  https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/collectors/FeeCollector.sol#L479

Impact

• Earlier claim of RAACtokens for other users will cause users to lose voting power.

• Attacker whose rewards are yet unclaimed will gather more voting power and earn more from the yield generation.

Tools Used

Manual review.

Recommendations

Add check that only original users can claim rewards.