Submission Details
Severity:
The reward distribution system in `FeeCollector` contract is broken
Summary
The FeeCollector contract creates TimeWeightedAverage periods for reward distribution but never uses them for calculations.
Vulnerability Details
The contract creates 7-day periods in _processDistributions:
if (totalVeRAACSupply > 0) {
TimeWeightedAverage.createPeriod(
distributionPeriod,
block.timestamp + 1,
7 days,
shares[0],
totalVeRAACSupply
);
But calculates rewards in _calculatePendingRewards using point-in-time ratios:
uint256 share = (totalDistributed * userVotingPower) / totalVotingPower;
Impact
High: Ignores intended time-weighted distribution mechanism, incorectly distributing rewards.
Recommendations
Calculate the rewards using TimeWeightedAverage.calculateAverage.
Updates
Lead Judging Commences
inallhonesty 5 months ago
Submission Judgement Published Assigned finding tags:
Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`
inallhonesty 5 months ago
Submission Judgement Published Assigned finding tags:
Time-Weighted Average Logic is Not Applied to Reward Distribution in `FeeCollector`
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.