Submission Details
Severity:
when the contract is paused for a long time and then unpaused all of the vestedScedules can be released for their fullest amount
Summary
If the RAACReleaseOrchestrator is paused for more than 90 days, and then unpaused all of the vested scedules can be released and there will be not enough raac token in the pool.
Vulnerability Details
When the contract is paused the block.timestamp is still updating this means that even if the contract is paused the vestedAmount grows bigger and bigger everyday
function _calculateReleasableAmount(
VestingSchedule memory schedule
) internal view returns (uint256) {
//code
uint256 vestedAmount = (schedule.totalAmount * timeFromStart) /
schedule.duration;
return vestedAmount - schedule.releasedAmount;
}
Impact
There wouldn't be enough RAAC tokens when all of the vested schedules are released one after another for their fullest amount
Tools Used
Recommendations
Add the duration time from pausing and unpausing the protocol to the schedule.duration of all vested scedules
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.