Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Reward Distribution Vulnerability Due to Dynamic Voting Power Calculation

aksoy

Summary

The FeeCollector claimRewards function calculates pending rewards based on the user's current voting power and total voting power at the time of claiming. This allows users to manipulate their rewards by creating new locks potentially reducing rewards for older users. The issue arises because the reward calculation does not account for historical voting power but instead uses the current state.

Vulnerability Details

The reward calculation uses the user's current voting power (veRAACToken.getVotingPower(user)) and total voting power (veRAACToken.getTotalVotingPower()). This allows a new users to claim fees for old rewards which is reducing rewards for older users.

function _calculatePendingRewards(address user) internal view returns (uint256) {
uint256 userVotingPower = veRAACToken.getVotingPower(user);
if (userVotingPower == 0) return 0;
​
uint256 totalVotingPower = veRAACToken.getTotalVotingPower();
if (totalVotingPower == 0) return 0;
uint256 share = (totalDistributed * userVotingPower) / totalVotingPower;
return share > userRewards[user] ? share - userRewards[user] : 0;
}
// View functions
/**
* @notice Gets the current voting power for an account
* @dev Calculates voting power based on lock amount and remaining time
* @param account The address to check voting power for
* @return The current voting power of the account
*/
function getVotingPower(address account) public view returns (uint256) {
return _votingState.getCurrentPower(account, block.timestamp);
}
​

Impact

The reward calculation does not use a snapshot of the user's voting power at the time of reward distribution. Instead, it dynamically calculates rewards based on the current state, which can be manipulated.

Tools Used

Manual

Recommendations

Implement a different distribution logic to prevent new users claiming rewards.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.