Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

RAACToken - Incomplete token burn when fee collector is not set

holydevoti0n

Summary

The burn function in RAACToken fails to handle the full burn amount when a burn tax is set but no fee collector is configured. This results in only a partial burn of tokens, with the tax amount remaining in the user's wallet.

Vulnerability Details

When a user calls the burn function:

  1. The function calculates a tax amount based on burnTaxRate

  2. It burns (amount - taxAmount) tokens

  3. If feeCollector is not set (address(0)), the tax portion is neither burned nor transferred

  4. This leaves the tax portion of tokens in the user's wallet, contrary to the burn intention

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
@> _burn(msg.sender, amount - taxAmount);
@> if (taxAmount > 0 && feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount);
}
}

Impact

Users attempting to burn tokens when no fee collector is set will have fewer tokens burned than requested.

This affects both direct users and integrated protocols that might account for the full burn amount in their calculations, potentially leading to accounting mismatches and economic model discrepancies. It breaks the ERC20 standard.

Tools Used

Manual Review

Recommendations

Modify the burn function to handle the full amount when no fee collector is set:

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
if (feeCollector != address(0)) {
_burn(msg.sender, amount - taxAmount);
_transfer(msg.sender, feeCollector, taxAmount);
} else {
_burn(msg.sender, amount);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn incorrectly deducts tax amount but doesn't burn or transfer it when feeCollector is address(0), preventing complete token burns

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn incorrectly deducts tax amount but doesn't burn or transfer it when feeCollector is address(0), preventing complete token burns

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.