Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: low
Invalid

Double RAAC reward minting in deposit function wastes gas

Summary

The StabilityPool::deposit() function calls _mintRAACRewards() twice unnecessarily - once through _update() and once directly, leading to wasted gas since the second call has no effect.

Vulnerability Details

The issue occurs in the deposit function:

function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update(); // First call to _mintRAACRewards()
rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
deToken.mint(msg.sender, deCRVUSDAmount);
userDeposits[msg.sender] += amount;
_mintRAACRewards(); // Second redundant call
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}

The root cause is that _update() already calls _mintRAACRewards(), making the second direct call redundant since RAAC rewards are time-dependent and won't change within the same transaction.

Impact

The redundant call to _mintRAACRewards() wastes gas by:

  1. Making an unnecessary external call to the RAACMinter contract

  2. Performing duplicate state reads/computations

While this doesn't affect the security or functionality of the protocol, it creates unnecessary overhead.

Recommendations

Remove redundant call

function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update();
rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
deToken.mint(msg.sender, deCRVUSDAmount);
userDeposits[msg.sender] += amount;
- _mintRAACRewards();
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!