Core Contracts

Summary

Depositors can repeatedly call the StabilityPool::withdraw function to drain RAAC rewards. This allows a malicious participant to “steal” rewards by repeatedly withdrawing a small amount, while the reward calculation remains based on the full RAAC reward balance of the contract without properly updating the depositor’s rewards state.

Vulnerability Details

The issue is found in the withdraw logic of the StabilityPool contract. In the withdraw function, after the scaled deposit is reduced the function calculates the RAAC rewards using the function:

Link to github code

Since the contract balance of RAAC tokens (which forms the basis for reward calculation) is not adjusted or “drained” appropriately during each withdrawal, a depositor can call withdraw multiple times with a small amount. Each call distributes a portion of the rewards—even if only a minimal amount of deposited rToken is removed—and the remaining reward balance still reflects nearly the entire accumulated rewards.

Proof of Concept
The following test case can be added to the StabilityPool.test.js file under the "RAAC Rewards" describe

Impact

• Reward Draining: A malicious depositor may abuse the repeated withdrawal pattern to drain a disproportionate share of RAAC rewards from the StabilityPool.

• Economic Loss: Other depositors will receive fewer rewards than expected, potentially causing a loss of funds or a misalignment of incentives within the protocol.

Tools Used

• Manual Code Review

• Foundry and Hardhat (via unit tests such as in StabilityPool.test.js)

Recommendations

1. State Update Post-Withdrawal:
   Modify the withdrawal process so that once rewards are claimed or paid out, the contract’s RAAC reward state is adjusted. For example, track individual users’ withdrawn reward amounts or update a cumulative “reward debt” variable.

2. Separate the Reward Claim Process:
   Introduce a distinct function for claiming RAAC rewards such that once a user claims their rewards, the available pool balance is decreased accordingly.