Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

`RAACMinter.tick()` Lacks Access Control

kupiasec

Summary

The RAACMinter.tick() function can be called by anyone. This function mints rewards based on the emission rate, which is influenced by the current utilization rate. Although it is intended to be callable only by the StabilityPool, unrestricted access allows frequent calls by anyone, leading to different outcomes.

Vulnerability Details

The RAACMinter.tick() function lacks proper access control. It is designed to be invoked from the StabilityPool, but any user can call it at any time.

The tick() function mints rewards according to the emission rate influenced by the current utilization rate. Ideally, the emission rate should only be updated during calls from the StabilityPool. However, unrestricted access allows anyone to call this function frequently, resulting in the emission rate being updated with each call, reflecting the utilization rate at that moment, which can lead to varying outcomes.

function tick() external nonReentrant whenNotPaused {
if (emissionUpdateInterval == 0 || block.timestamp >= lastEmissionUpdateTimestamp + emissionUpdateInterval) {
updateEmissionRate();
}
uint256 currentBlock = block.number;
uint256 blocksSinceLastUpdate = currentBlock - lastUpdateBlock;
if (blocksSinceLastUpdate > 0) {
uint256 amountToMint = emissionRate * blocksSinceLastUpdate;
​
if (amountToMint > 0) {
excessTokens += amountToMint;
lastUpdateBlock = currentBlock;
raacToken.mint(address(stabilityPool), amountToMint);
emit RAACMinted(amountToMint);
}
}
}

Impact

Unrestricted access allows anyone to call this function frequently, which can adversely affect the amount of rewards minted.

Tools Used

Manual review

Recommendations

Implement access control to ensure that the function can only be called by the StabilityPool.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!