Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

The calculation for reward distribution is incorrect.

kupiasec

Summary

The reward amount of a user is calculated with his own voting power which can change. In addition, users can claim their pending rewards any time. This calculation is completely incorrect, which could result in severe imbalance.

Vulnerability Details

The amount of rewards that should be given to a user is proportional to his own voting power. However, the amount of total rewards and the voting power of every users can change.
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/collectors/FeeCollector.sol#L479-L488

function _calculatePendingRewards(address user) internal view returns (uint256) {
uint256 userVotingPower = veRAACToken.getVotingPower(user);
if (userVotingPower == 0) return 0;
​
uint256 totalVotingPower = veRAACToken.getTotalVotingPower();
if (totalVotingPower == 0) return 0;
@> uint256 share = (totalDistributed * userVotingPower) / totalVotingPower;
return share > userRewards[user] ? share - userRewards[user] : 0;
}

This calculation is completely incorrect, which could result in severe imbalance.
Consider the following scenario:

  1. Alice's voting power is 100.

  2. Bob's voting power is 50.

  3. The total amount of rewards is 1500.

  4. Alice claims her pending rewards.
    The amount of pending rewards is 1500 * 100 / (100 + 50) = 1000.
    The remaining amount of rewards is 1500 - 100 =500

  5. Bob's voting power changes from 50 to 2000.

  6. Bob claims his pending rewards.
    The amount of pending rewards is 1500 * 200 / (100 + 200) = 1000.
    But there are only 500 tokens left.
    As a result, Bob cannot claim his rewards.

Impact

Incorrect rewards calculation.

Recommendations

Reward calculation mechanism should be improved.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!