Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

RAACNFT does not provide any function to withdraw tokens

biakia

Summary

The RAACNFT contract allows users to mint NFTs by transferring ERC20 tokens to the contract. However, the contract does not provide any function to withdraw these tokens. As a result, the ERC20 tokens sent by users during the minting process will be permanently locked in the contract, leading to a loss of funds.

Vulnerability Details

The mint function in the RAACNFT contract transfers ERC20 tokens from the user to the contract using token.safeTransferFrom.

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

However, there is no mechanism or function in the contract to withdraw these tokens. This means that any ERC20 tokens sent to the contract during the minting process will remain stuck in the contract forever.

Impact

  • Permanent Lock of Funds: The ERC20 tokens transferred to the contract during minting cannot be retrieved, leading to a permanent loss of funds.

  • Contract Owner's Loss: If the contract owner intended to collect these tokens, they will be unable to access them.

The impact is High, the likelihood is High, so the severity is High.

Tools Used

Manual Review

Recommendations

To fix this issue, add a function that allows the contract owner (or a designated address) to withdraw the ERC20 tokens from the contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.