Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect updation of userRewards in Feecollector causes loss of user funds

anonymousjoe

Summary

After a user claims their rewards in the claimRewards()function in the FeeCollector.sol, the userRewards[user] is incorrectly updated to totalDistributed instead of pendingRewards.

Vulnerability Details

function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) {
if (user == address(0)) revert InvalidAddress();
uint256 pendingReward = _calculatePendingRewards(user);
if (pendingReward == 0) revert InsufficientBalance();
// Reset user rewards before transfer
userRewards[user] = totalDistributed; // bug is in this line
// Transfer rewards
raacToken.safeTransfer(user, pendingReward);
emit RewardClaimed(user, pendingReward);
return pendingReward;
}

totalDistributedis the total rewards available for all the users, and userRewards[user]is supposed to be the amount of rewards actually claimed by the users before. So because of this incorrect updation, the next time the user tries to claim the rewards they will receive less/0 rewards than they deserved.


This can be understood by seeing how the rewards are actually calculated:

function _calculatePendingRewards(address user) internal view returns (uint256) {
uint256 userVotingPower = veRAACToken.getVotingPower(user);
if (userVotingPower == 0) return 0;
​
uint256 totalVotingPower = veRAACToken.getTotalVotingPower();
if (totalVotingPower == 0) return 0;
uint256 share = (totalDistributed * userVotingPower) / totalVotingPower;
return share > userRewards[user] ? share - userRewards[user] : 0;
// subtracting new rewards from how much user has already claimed
}
​

Impact

Loss of user funds

Tools Used

manual review

Recommendations

update the value to pendingRewardsinstead of totalDistributed

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::claimRewards sets `userRewards[user]` to `totalDistributed` seriously grieving users from rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.