Core Contracts

Summary

In RAACMinter::tick(), when the emission rate is updated, the new rate is applied retroactively to all blocks since the last update. This means that if the emission rate increases, more tokens will be minted for past blocks than should have been based on the rates that were active during those blocks.

This creates an incentive for users to delay calling tick() until after emission rate increases, as they will receive inflated rewards for past blocks based on the new higher rate.

Vulnerability Details

1. Assume current emission rate is 100 tokens/block

2. No one calls tick() for 100 blocks

3. Utilization increases, causing emission rate to update to 200 tokens/block

4. When tick() is finally called:

   • Should mint: 100 blocks * 100 tokens = 10,000 tokens

   • Actually mints: 100 blocks * 200 tokens = 20,000 tokens

Impact

The protocol will mint more tokens than intended by the emission schedule, leading to:

1. Inflated token supply

2. Unfair distribution of rewards

3. Economic imbalance in the protocol

Recommendations

Ensure rewards are calculated based on the emission rates that were actually active during each period.