Submission Details
Severity:
Calculation of raac rewards is done incorrectly in stability pool
Summary
Calculation of raac rewards is done incorrectly in stability pool
Vulnerability Details
Following is how calculation is done
function calculateRaacRewards(address user) public view returns (uint256) {
uint256 userDeposit = userDeposits[user];
uint256 totalDeposits = deToken.totalSupply();
uint256 totalRewards = raacToken.balanceOf(address(this));
if (totalDeposits < 1e6) return 0;
return (totalRewards * userDeposit) / totalDeposits;
}
Now we know that de token has different decimals and user deposits are in r token decimals therefore two variables which have different variables are used which can will cause either over estimation of rewarda or underestimation of the rewards.
Impact
Wrong calculation of the rewards
Tools Used
Recommendations
Instead of detoken.Totalsupply use total rtoken balance of the contract.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.