Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

The emission rate in RAACMinter contract is dependent on the block time of the underlying EVM-compatible chain.

tadev

Summary

BLOCKS_PER_DAY is hardcoded and assumes a 12-second block time, which will not hold on all EVM-compatible chain and might also not hold on Ethereum in the future.

Constructor sets emissionRate with :

emissionRate = INITIAL_RATE / BLOCKS_PER_DAY;

This means initially, the protocol assumes the EVM it is deploying on has a 12-sec block time.

Vulnerability Details

The issue is important as it means that once deployed, the protocol will have a faster emission on Polygon (2-sec block time) than on Ethereum for example.

The tick function is defined as follows:

function tick() external nonReentrant whenNotPaused {
if (emissionUpdateInterval == 0 || block.timestamp >= lastEmissionUpdateTimestamp + emissionUpdateInterval) {
updateEmissionRate();
}
uint256 currentBlock = block.number;
uint256 blocksSinceLastUpdate = currentBlock - lastUpdateBlock;
if (blocksSinceLastUpdate > 0) {
uint256 amountToMint = emissionRate * blocksSinceLastUpdate;
​
if (amountToMint > 0) {
excessTokens += amountToMint;
lastUpdateBlock = currentBlock;
raacToken.mint(address(stabilityPool), amountToMint);
emit RAACMinted(amountToMint);
}
}
}

We can see that amountToMint is directly dependent on the block time, as more blocks will be added if block time is shorter.

Impact

The impact of this issue is high, given that it makes emission dependent on the rhythm of block production. Deploying the protocol on Polygon or Optimism with around 2 seconds per block will lead to 6 times more RAAC tokens minted in the same compared to Ethereum with 12 seconds per block.

Also, Ethereum might reduce the block time in the future, which will directly impact the emission rate of RAAC token.

This means emission rate can be guaranteed.

Tools Used

Manual review.

Recommendations

Emission logic should be modified, potentially using block.timestamp instead of block.number to ensure a predictable and chain-independent emission rate.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter hardcoded BLOCKS_PER_DAY breaks cross-chain compatibility with variable token emission rates

Known issue LightChaser M12

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter hardcoded BLOCKS_PER_DAY breaks cross-chain compatibility with variable token emission rates

Known issue LightChaser M12

Appeal created

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

RAACMinter hardcoded BLOCKS_PER_DAY breaks cross-chain compatibility with variable token emission rates

Known issue LightChaser M12

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.