Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

The `totalDistributed` is not being getting properl updated in the FeeCollector.sol

hard1k

Summary

The totalDistributed in the FeeCollector.sol is a storage variable that represents Total tokens distributed historically meaning that this is supposed to be updated everytime the fees/tokens are distributed among the different FeeTypes or accoridng to the protocol rules

Vulnerability Details

When the distributeCollectedFees is called what it does is that Distributes collected fees according to protocol rules and Calculates shares for veRAAC holders, burn, repair fund and treasury. After calculating fees it calls an internal function i.e processDistributions what this does is that it takes the calculated shares into account and transfers them accordingly, like some part of shares is for the veRAACHolders if any, some of it is for the treasury and some for the repairFund. However the totalDistributed var mentioned above is only updated when there are veRAACToken holders but when in these two lines when the tokens are transferred to the treasury and repairFund, the totalDistributed var is not being updated even when it is supposed to be. As that state var tracks and accounts for the total tokens that were or are distributed historically throughout.

Code Snippets

function _processDistributions(uint256 totalFees, uint256[4] memory shares) internal {
uint256 contractBalance = raacToken.balanceOf(address(this));
if (contractBalance < totalFees) revert InsufficientBalance();
​
​
if (shares[0] > 0) {
uint256 totalVeRAACSupply = veRAACToken.getTotalVotingPower();
if (totalVeRAACSupply > 0) {
TimeWeightedAverage.createPeriod(
distributionPeriod,
block.timestamp + 1,
7 days,
shares[0],
totalVeRAACSupply
);
totalDistributed += shares[0];
} else {
shares[3] += shares[0]; // Add to treasury if no veRAAC holders
}
}
​
//AUDIT- the the totalDistributed is only being updated when the tokens are being sent to veRAAC holders but not in the below
//transfers, this is problematic because this state var is the total tokens distributed historically(see natspec)
if (shares[1] > 0) raacToken.burn(shares[1]);
if (shares[2] > 0) raacToken.safeTransfer(repairFund, shares[2]);
if (shares[3] > 0) raacToken.safeTransfer(treasury, shares[3]);```
``` * - totalDistributed Total tokens distributed historically
*/
TimeWeightedAverage.Period public distributionPeriod;
mapping(address => uint256) public userRewards;
uint256 public totalDistributed;
​

Recommendations

Update the totalDistributed state whenever there is a transfer of tokens or fees as that is supposed to keep trac of the tokens distributed throughout

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!