Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Lost protocol fees due to incompatible fee collection design

holydevoti0n

Vulnerability Details

The protocol's fee collection system is fundamentally broken due to incompatible fee-handling mechanisms. The RAACToken sends fees directly to the FeeCollector:

// In RAACToken.sol
_update(from, feeCollector, totalTax - burnAmount);

However, the FeeCollector's distribution logic relies on an internal accounting system that is only updated through the collectFee() function, which is never called:

// In FeeCollector.sol
function _calculateTotalFees() internal view returns (uint256) {
return collectedFees.protocolFees +
collectedFees.lendingFees +
// ... other fees
collectedFees.nftRoyalties;
}

Since the tokens sent from RAACToken bypass the collectFee() function, _calculateTotalFees() will always return zero, despite the contract having a non-zero token balance.

Impact

  • All collected fees are effectively locked in the FeeCollector contract

  • Fee distribution mechanism is completely non-functional

  • Protocol's revenue distribution system is entirely broken

Tools Used

Manual Review

Recommendations

Redesign the fee distribution system in FeeCollector to work with actual token balances instead of internal accounting.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.