Core Contracts

Summary

When collateral is sunset (disabled) and later reintroduced, the contract fails to reset error-tracking variables related to collateral gain calculations.

• This can lead to over-distribution of rewards, potentially draining the collateral pool unfairly.

• The last user to claim rewards may receive nothing, as prior claims could deplete the available balance.

The function _update() is executed in deposit() and withdraw(), but it does not handle resetting error offsets, leading to reward misallocations:

Vulnerability Details

In the RAAC StabilityPool, when a collateral type is disabled (sunset) and later re-enabled, the lastCollateralError_Offset is not reset. This results in:

1. Early withdrawers getting more rewards than they should.

2. Later withdrawers losing rewards because the pool is prematurely drained.

** Setup for the Attack in RAAC Codebase**

Let's assume we have three users (Alice, Bob, and Charlie) interacting with StabilityPool.sol. The following functions are involved:

Step 1: Users Deposit Collateral

Alice, Bob, and Charlie deposit rToken into the pool, expecting proportional rewards.

Each user expects rewards based on deposit share.

Step 2: Governance Disables Collateral

At some point, governance sunsets collateral, preventing new deposits/withdrawals.

This locks existing collateral and stops reward accumulation.
But it does NOT reset lastCollateralError_Offset.

** Step 3: Governance Re-Enables Collateral**

After some time, governance re-enables collateral.

Bug: lastCollateralError_Offset is NOT reset.
This causes incorrect reward calculations.

Step 4: Users Withdraw (Exploit)

• Alice withdraws first:

  StabilityPool.withdraw(1000);

  ​

  She receives excessive rewards because error offset was not reset.

• Bob withdraws next:

  StabilityPool.withdraw(2000);

  ​

  Bob also gets more than he should.

• Charlie withdraws last:

  StabilityPool.withdraw(500);

  ​

  Pool is drained, and Charlie gets nothing.
  Loss of fairness – later withdrawers are impacted.

Impact

Users may claim more rewards than available, creating a shortfall in the reward pool.

• The last user attempting to claim may receive nothing, causing fund loss for them.

• This can lead to unexpected behavior in the stability mechanism, disrupting fair reward allocation.

Tools Used

Manual Review

Recommendations

Reset Offsets When Re-Enabling Collateral

Modify addMarket() to reset tracking variables using some mechanism.