Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Inaccurate `totalDeposits` calculation in `calculateRaacRewards()`

tigerfrake

Summary

The calculateRaacRewards() function in the StabilityPool contract currently uses deToken.totalSupply() to determine the total deposits for calculating user rewards. This approach does not accurately reflect the actual rToken deposits made by users, leading to potential inaccuracies in reward distribution.

Vulnerability Details

When users invoke deposit() function, they specify the amount of rToken they wish to supply. This amount is then incremented to their userDeposits mapping and deTokens minted to them.

function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update();
>> rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
>> deToken.mint(msg.sender, deCRVUSDAmount);
​
>> userDeposits[msg.sender] += amount;
---SNIP---
}

However, when calculating rewards, the calculateRaacRewards() function does the following:

function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
// @audit-issue These are not deposits
>> uint256 totalDeposits = deToken.totalSupply();
​
uint256 totalRewards = raacToken.balanceOf(address(this));
if (totalDeposits < 1e6) return 0;
​
return (totalRewards * userDeposit) / totalDeposits;
}

  • The function retrieves total deposits using uint256 totalDeposits = deToken.totalSupply().
    This method does not account for the actual rToken deposited by users, as deToken is a derivative token.

  • As a result, users may receive rewards that do not correspond to their actual contributions, leading to incorrect distribution.

Impact

The reward calculation is based on the total supply of deToken, rather than their actual rToken deposits. This misalignment undermines the intended reward distribution mechanism.

Tools Used

Manual Review

Recommendations

Update the reward calculation to use the actual balance of rToken held by the contract:

function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
// @audit Use deposits
- uint256 totalDeposits = deToken.totalSupply();
+ uint256 totalDeposits = rToken.balanceOf(address(this));
​
uint256 totalRewards = raacToken.balanceOf(address(this));
if (totalDeposits < 1e6) return 0;
​
return (totalRewards * userDeposit) / totalDeposits;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.