Core Contracts

Summary

The emergencyRevoke function in RAACReleaseOrchestrator.sol ignores the return value of the transfer function, potentially allowing a failed token transfer to go unnoticed.

Vulnerability Details

Within the emergencyRevoke function , the following call is made without verifying its return value:

If the transfer fails (returns false instead of reverting), the contract will proceed as if the tokens were successfully revoked, leading to an inaccurate contract state.

Impact

1. Inconsistent Token Accounting: The contract may assume tokens were revoked while they remain in the recipient’s balance.

2. Security Risk: If this function is relied upon for emergency recovery, failures in token transfers could prevent proper fund management.

This issue is likely when interacting with ERC20 tokens that return false on failure instead of reverting. It is a common oversight in token transfer operations.

If raacToken.transfer(address(this), unreleasedAmount) fails and returns false, the function will proceed without reverting, falsely assuming that the tokens were successfully revoked.

Tools Used

github

Recommendations

Always check the return value of the transfer function to ensure a successful transaction: