Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

RAACToken burn and transfer tax/fee will not be distributed to intended addresses

ace_30

Summary

Raactoken transfers the burn and transfer fee (tax) directly to the feeCollector without calling its function to collect the fee. As a result, the fee is not allocated to the correct feeType, and the fee will not be distributed properly.

Vulnerability Details

Here’s the relevant code snippet from the RAACToken functions:

function burn(uint256 amount) external {
--snip--
_transfer(msg.sender, feeCollector, taxAmount);
}
​
function _update(
address from,
address to,
uint256 amount
) internal virtual override {
--snip--
super._update(from, feeCollector, totalTax - burnAmount);
super._update(from, address(0), burnAmount);
super._update(from, to, amount - totalTax);
}

This directly transfers the tax amount to the feeCollector without calling the collectFee function:

function collectFee(uint256 amount, uint8 feeType) external override nonReentrant whenNotPaused returns (bool) {
if (amount == 0 || amount > MAX_FEE_AMOUNT) revert InvalidFeeAmount();
if (feeType > 7) revert InvalidFeeType();
// Transfer tokens from sender
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Update collected fees
_updateCollectedFees(amount, feeType);
emit FeeCollected(feeType, amount);
return true;
}

Impact

RAACToken burn and transfer tax/fee will not be distributed to intended addresses

Tools Used

vscode

Recommendations

Instead of calling _transfer and _update for transferring tax/fe to feeCollector, trigger a call to the collectFee function, ensuring the fee is properly allocated to the correct feeType and distributed accordingly.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!