Core Contracts

Summary

Lack of type(uint256).max amount checks in deposit/stake functions across multiple contracts can lead to incorrect accounting and system instability when users interact with tokens like cUSDCv3 that have non-standard transfer behavior.

Vulnerability Details

Several functions across different contracts (RAACNFT.sol, FeeCollector.sol, StabilityPool.sol, veRAACToken.sol, BoostController.sol, GaugeController.sol, and Treasury.sol) accept an amount parameter for deposit or staking operations without validating if this amount is equal to type(uint256).max.

*Vulnerable Code Instances *

RAACNFT.sol.mint:

all contracts have this problem in list i gave

Impact

Accounting Errors and System Instability. If a user deposits type(uint256).max amount of a token like cUSDCv3, the actual transferred amount will be the user's entire balance of that token, not type(uint256).max. However, the system will record the deposit amount as type(uint256).max, leading to:

• Incorrect User Balances: User deposit records will be inflated to type(uint256).max, while their actual deposit is much smaller.

• Accounting Discrepancies: The system's internal accounting will be skewed, as it will track vastly inflated deposit amounts.

• Potential Exploits: Attackers could potentially leverage these accounting discrepancies to exploit reward mechanisms, borrowing power calculations, or other system logic that relies on accurate deposit amounts.

• System Instability: Large discrepancies between recorded and actual deposits can destabilize the entire protocol, making it difficult to manage liquidity, calculate interest rates, and ensure fair operation.

Tools Used

Manual review

Recommendations

1. Immediate Mitigation: Add a check in all deposit/stake functions across the listed contracts to revert if the amount parameter is equal to type(uint256).max. This will prevent users from depositing or staking this specific amount and triggering the vulnerability.

1. Code Review: Thoroughly review all deposit/stake functions across all contracts in the codebase and ensure that similar type(uint256).max amount checks are implemented.