Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Misleading RAACMinted Event in mintRewards::RAACMinter.sol

oluwaseyisekoni

Summary

The mintRewards function emits an event named RAACMinted with the parameter amount, which represents the total number of raacToken transferred to the recipient (to). This amount comprises both newly minted tokens (toMint) and pre-existing tokens from the excessTokens reserve. However, the event name RAACMinted implies that it tracks only the minting of new tokens, creating a potential misnomer.

Vulnerability Details

function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {
if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();
uint256 toMint = excessTokens >= amount ? 0 : amount - excessTokens;
excessTokens = excessTokens >= amount ? excessTokens - amount : 0;
​
if (toMint > 0) {
raacToken.mint(address(this), toMint);
}
raacToken.safeTransfer(to, amount);
>> emit RAACMinted(amount); // Event in question
}

Impact

Indexers, dashboards, or analytics tools monitoring RAACMinted assume amount reflects only newly minted tokens, overestimating the inflation of raacToken supply.

Tools Used

manual review

Recommendations

Emit Only Minted Amount:
Keep RAACMinted for toMint:

​
if (toMint > 0) {
raacToken.mint(address(this), toMint);
+ emit RAACMinted(toMint); // Only minted amount
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter.mintRewards() emits incorrect event value when called

suggestion is something that is done by ERC20.mint() function

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter.mintRewards() emits incorrect event value when called

suggestion is something that is done by ERC20.mint() function

Appeal created

inallhonesty Lead Judge
3 months ago
inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

RAACMinter.mintRewards() emits incorrect event value when called

suggestion is something that is done by ERC20.mint() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.