Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

RAACToken burn and transfer tax/fee will not be distributed to intended addresses

ace_30

Summary

Raactoken transfers the burn and transfer fee (tax) directly to the feeCollector without calling its function to collect the fee. As a result, the fee is not allocated to the correct feeType, and the fee will not be distributed properly.

Vulnerability Details

Here’s the relevant code snippet from the RAACToken functions:

function burn(uint256 amount) external {
--snip--
_transfer(msg.sender, feeCollector, taxAmount);
}
​
function _update(
address from,
address to,
uint256 amount
) internal virtual override {
--snip--
super._update(from, feeCollector, totalTax - burnAmount);
super._update(from, address(0), burnAmount);
super._update(from, to, amount - totalTax);
}

This directly transfers the tax amount to the feeCollector without calling the collectFee function:

function collectFee(uint256 amount, uint8 feeType) external override nonReentrant whenNotPaused returns (bool) {
if (amount == 0 || amount > MAX_FEE_AMOUNT) revert InvalidFeeAmount();
if (feeType > 7) revert InvalidFeeType();
// Transfer tokens from sender
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Update collected fees
_updateCollectedFees(amount, feeType);
emit FeeCollected(feeType, amount);
return true;
}

Impact

RAACToken burn and transfer tax/fee will not be distributed to intended addresses

Tools Used

vscode

Recommendations

Instead of calling _transfer and _update for transferring tax/fe to feeCollector, trigger a call to the collectFee function, ensuring the fee is properly allocated to the correct feeType and distributed accordingly.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.