Core Contracts

Summary

The StabilityPool.calculateRaacRewards() function calculates the user reward amount based on the current ratio between the user's deposit amount and the total deposit amount. This mechanism is flawed. If a user withdraws 1 wei multiple times, they will receive nearly the same reward for each withdrawal, allowing them to drain almost all the rewards.

Vulnerability Details

The StabilityPool.calculateRaacRewards() function calculates the user reward amount based on the current ratio between the user's deposit amount and the total deposit amount.

A malicious user can drain almost all the rewards. For example:

• totalRewards: 100

• totalDeposits: 1000

• userDeposit: 500

1. The malicious user withdraws 1:

   • They receive a reward amount of (100 * 500 / 1000) = 50

   • totalRewards: 50

   • totalDeposits: 999

   • userDeposit: 499

2. The malicious user withdraws 1 again:

   • They receive a reward amount of (50 * 499 / 999) = 24.97

   • totalRewards: 25.03

   • totalDeposits: 998

   • userDeposit: 498

As demonstrated, in each step, the malicious user can receive nearly half of the total rewards. By iterating this withdrawal process, they can drain almost all the rewards.

Impact

A malicious user can drain almost all the rewards.

Tools Used

Manual review

Recommendations

Implement an individual reward index.