Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

There is no minimum time requirement for depositors to be eligible for rewards

0xdanielc

Summary

Increases to raac rewards can be exploited for no risk, diverting rewards away from legitimate stakers.

Vulnerability Details

The structure of calcluateRaacRewards leaves front running a likely possibility.

function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
uint256 totalDeposits = deToken.totalSupply();
​
uint256 totalRewards = raacToken.balanceOf(address(this));
if (totalDeposits < 1e6) return 0;
​
return (totalRewards * userDeposit) / totalDeposits;
}

Rewards are dependent upon the proportion of the total deposits a user's deposits consist of. Also, there is no requirement for minimum deposit length of time. As a result a user deposits through StabilityPool::deposit

function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update();
rToken.safeTransferFrom(msg.sender, address(this), amount);
​
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
deToken.mint(msg.sender, deCRVUSDAmount);
userDeposits[msg.sender] += amount;
​
_mintRAACRewards();
​
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}

This then calls StabilityPool::_mintRAACRewards, minting new rewards to the pool.

function _mintRAACRewards() internal {
if (address(raacMinter) != address(0)) {
raacMinter.tick();
}
}

Immediately after that, a user could call withdraw, seizing rewards for no risk to themselves, and also, they will have provided no liquidity for the protocol, extracting rewards despite taking no risk and providing no value.

Note this attack could be amplified in magnitude through the use of a flash loan.

Impact

Rewards are misallocated towards exploitative users away from innocent users.

Tools Used

Manual review

Recommendations

Implement a reward system dependent upon time deposited

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards is vulnerable to just in time deposits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.