Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing logic for distrubuting deposited Raac token

smacaud1

Summary

The depositRAACFromPool() lacks manager reward distribution logic despite accepting RAAC deposits .This omission leaves deposited funds stranded in the contract.

Vulnerability Details

There is a missing logic for distributing deposited raac to managers based on allocation

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/StabilityPool/StabilityPool.sol#L334

function depositRAACFromPool(uint256 amount) external onlyLiquidityPool validAmount(amount) {
uint256 preBalance = raacToken.balanceOf(address(this));
​
raacToken.safeTransferFrom(msg.sender, address(this), amount);
​
uint256 postBalance = raacToken.balanceOf(address(this));
if (postBalance != preBalance + amount) revert InvalidTransfer();
​
// TODO: Logic for distributing to managers based on allocation
​
emit RAACDepositedFromPool(msg.sender, amount);
}

Impact

The deposited raac token will remain idle in the contract

Tools Used

Manual reveiw

Recommendations

Complete the distribution to managers logic

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards uses contract balance for reward calculation, incorrectly including tokens meant for manager allocation - Manager allocation not implemented

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!