Attacker can steal RAAC rewards using flashloan
Vulnerability Details
RAACMinter mints RAAC rewards for every block based on the emission rate, this is supposed to withdrawn by people who stake RToken amount through StabilityPool::deposit.
The problem is that we are accouting how much raac rewards each user should get based on the amount of RToken they have deposited and for how much time, when a user withdraws their deposited amount we are calculating the amount raac rewards a user is eligible for through calculateRaacRewards.
The problem lies in this function as attacker can inflate his deposit amount by using flashloan to get CrvUSD, convert those CrvUSD to RTokens though LendingPool and then deposit it in the StabilityPool for a single transaction and get almost all of the raacRewards.
Impact
Attacker can steal raacRewards from innocent users who deposited RTokens from the start of the interval
Tools Used
Manual Review
Recommendations
Users should get raacRewards based on the amount and duration of deposited RToken
Lead Judging Commences
StabilityPool::calculateRaacRewards is vulnerable to just in time deposits
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.