Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`mintRewards()`cannot be called by no one in `RAACMinter` contract

0xaadi

Summary

In RAACMinter contract, the mintRewards() function called by an external contract (stabilityPool), but there is no function within stabilityPool that calls mintRewards(). This suggests that mintRewards() is meant to be called manually rather than being triggered automatically within the contract system.

Vulnerability Details

The mintRewards() function is expected to be responsible for minting rewards, yet no function inside stabilityPool invokes it. This implies that mintRewards() must be called manually by an external actor (e.g., an admin). If the function is not invoked as intended, rewards may not be minted properly, potentially leading to an issue where users do not receive their expected rewards.

function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {
@> if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();
uint256 toMint = excessTokens >= amount ? 0 : amount - excessTokens;
excessTokens = excessTokens >= amount ? excessTokens - amount : 0;
​
​
if (toMint > 0) {
raacToken.mint(address(this), toMint);
}
raacToken.safeTransfer(to, amount);
emit RAACMinted(amount);
}

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/minters/RAACMinter/RAACMinter.sol#L181C1-L193C6

Impact

mintRewards()cannot be called by no one

Tools Used

Manual Review

Recommendations

Ensure proper access control is in place to prevent unauthorized calls to mintRewards().

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::mintRewards function is never called by StabilityPool despite being the only authorized caller, leaving intended reward functionality unused

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::mintRewards function is never called by StabilityPool despite being the only authorized caller, leaving intended reward functionality unused

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.