Core Contracts

Summary

In StabilityPool.sol, when collateral is removed or replaced, there’s a lack of tracking for previously accumulated rewards associated with that collateral.

This can lead to incorrect reward distributions when collateral types are sunset or updated.

Vulnerability Details

Scenario: Collateral Gets Replaced, Users Lose Rewards

Setup:

• User Alice deposits 1,000 rToken into the RAAC Stability Pool.

• The Stability Pool accumulates rewards in RAAC tokens over time.

• The reward distribution relies on the global state variables tracking user deposits and market allocations.

Step 1: Alice Deposits into StabilityPool

Alice deposits 1,000 rToken, and based on the exchange rate, she receives deTokens.

At this point, Alice starts earning rewards in RAAC tokens.

Step 2: RAAC Rewards Accumulate Over Time

As Alice keeps her deposit in the pool:

• The _mintRAACRewards() function mints new RAAC tokens periodically.

• Alice's rewards increase proportionally based on her deposit.

Step 3: Admin Replaces Collateral (Bug Trigger)

The protocol decides to replace an old collateral type (e.g., rToken) with a new version.

Issue: The global tracking variables are reset:

• marketAllocations[oldCollateral] is set to zero.

• totalAllocation gets recalculated without tracking old rewards.

• Any previously earned rewards that were still pending for Alice are lost.

Step 4: Alice Tries to Withdraw

When Alice withdraws, she expects to receive:

1. Her staked rToken (1,000).

2. Her accumulated RAAC rewards.

However, because the market allocations were reset, the pending rewards calculation fails.

Alice receives fewer rewards than expected, or in extreme cases, nothing at all.

Impact

Users lose rewards when collateral is updated.

The last users to claim might get no rewards if others claim first.

Tools Used

Manual Review

Recommendations

Track rewards separately per collateral type rather than globally.

Introduce a grace period after collateral replacement so users can claim old rewards.

Update withdraw() logic to check if pending rewards exist from old collateral before resetting state.