Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Reward can be stolen from Stability Pool by Malicious User

0xhacksmithh

Summary

Vulnerability Details

To uderstand this lets a look ovearall Deposit and Withdraw work-flow in Stability pool

DEPOSIT

  • RAACReward minted to contract

  • RToken transfered from User to Contract

  • corresponding deToken minted to User

  • User's deposit mapping get updated

  • RAACReward Minted to contract

WITHDRAW

  • RAACReward minted to contract

  • Corresponding RToken amount calculated

  • RAACReward for User calculated

  • Some sanity check, state update, then deToken burned

  • Corresponding RToken get transfered

  • Then if any reward for user present, Reward token transfered to caller

Here Buggy part is how reward is calculated

So any user can track how my reward is accumulated in StabilityPool

Then a Malicious User make flashloan / deposit huge amount of RToken to stability pool, then in next transaction call withdraw

As RaacReward calculated as following formula and Malicious User's Deposit balance is significantly high in pool, so he could take out a large chuck of rewards from he pool

(totalRewards * userDeposit) / totalDeposits;

Malicious User keep repeating this step when Stability pool accumulate reward

function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
uint256 totalDeposits = deToken.totalSupply();
​
uint256 totalRewards = raacToken.balanceOf(address(this));
if (totalDeposits < 1e6) return 0;
​
return (totalRewards * userDeposit) / totalDeposits;
}

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/StabilityPool/StabilityPool.sol#L251-L259

Impact

Genuine Users will loss their Rewards.

Tools Used

manual review

Recommendations

Implement something like timelock, or more appropriately indexing method which increase linearly with time

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards is vulnerable to just in time deposits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!