Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

No cooloff period

suitec9

Summary

A vulnerability has been identified in the withdraw functions of both LendingPool and StabilityPool contracts that allows for potential flash loan exploitation. Users can deposit and withdraw large amounts within the same block to extract liquidity and rewards inappropriately.

vulnerability Details

The vulnerability exists in two key functions:

LendingPool.sol and StabilityPool.sol functions

function withdraw(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
if (withdrawalsPaused) revert WithdrawalsArePaused();
ReserveLibrary.updateReserveState(reserve, rateData);
_ensureLiquidity(amount);
(uint256 amountWithdrawn, uint256 amountScaled, uint256 amountUnderlying)
ReserveLibrary.withdraw(reserve, rateData, amount, msg.sender);
_rebalanceLiquidity();
emit Withdraw(msg.sender, amountWithdrawn);
function withdraw(uint256 deCRVUSDAmount) external nonReentrant whenNotPaused validAmount(deCRVUSDAmount) {
_update();
if (deToken.balanceOf(msg.sender) < deCRVUSDAmount) revert InsufficientBalance();
uint256 rcrvUSDAmount = calculateRcrvUSDAmount(deCRVUSDAmount);
uint256 raacRewards = calculateRaacRewards(msg.sender);
// ... remaining implementation
}

The vulnerability has been proven through testing:

​
await stabilityPool.connect(myUser).deposit(initialAmount)
await stabilityPool.connect(myUser).withdraw(initialAmount)
const myUserRewards = await raacToken.balanceOf(myUser.address);
// User receives rewards: 2.177083333333333326

Impact

Potential for market manipulation through flash loan attacks

Unauthorized reward extraction

Possible drainage of protocol assets

Similar to the zkLend exploit which resulted in a $10M loss

Tools use

Manual code review

Unit testing with Hardhat

Reference analysis of zkLend exploit

sonnet 3.5 cluade Ai for to edit my report

Recommendations

Implement a cooldown period between deposits and withdrawals (minimum 12 seconds/1 block)

Add early withdrawal penalties to discourage quick deposit/withdraw cycles

Implement progressive reward vesting to ensure rewards are earned over time

Consider adding withdrawal limits per block

Add additional checks for flash loan detection

The most straightforward solution would be implementing a cooldown period, as it would effectively prevent same-block deposit/withdrawal attacks while maintaining legitimate user functionality.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::calculateRaacRewards is vulnerable to just in time deposits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!