Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

FeeCollector distributions are inaccurate due to RaacToken applying additional fees

ace_30

Summary

feeCollector._processDistributions() handles the distribution of collected fees. It calculates fee shares and then calls raacToken to either burn or transfer the fee amounts.

However, raacToken applies tax and fee rates again during these transfers and burns, causing inaccuracies in the distribution. As a result, veRaac holders and other stakeholders do not receive their full intended fees.

Vulnerability Details

FeeCollector admin callse distributeCollectedFees to distribute collected fees
It triggers _processDistributions which calculates exact amount of fee shares and burn/transfers the Raac tokens:

function _processDistributions(uint256 totalFees, uint256[4] memory shares) internal {
uint256 contractBalance = raacToken.balanceOf(address(this));
if (contractBalance < totalFees) revert InsufficientBalance();
​
if (shares[0] > 0) {
uint256 totalVeRAACSupply = veRAACToken.getTotalVotingPower();
if (totalVeRAACSupply > 0) {
TimeWeightedAverage.createPeriod(
distributionPeriod,
block.timestamp + 1,
7 days,
shares[0],
totalVeRAACSupply
);
totalDistributed += shares[0];
} else {
shares[3] += shares[0]; // Add to treasury if no veRAAC holders
}
}
​
if (shares[1] > 0) raacToken.burn(shares[1]);
if (shares[2] > 0) raacToken.safeTransfer(repairFund, shares[2]);
if (shares[3] > 0) raacToken.safeTransfer(treasury, shares[3]);
}

RAACToken applies fees again in transfer > _update (also in burn):

function _update(
address from,
address to,
uint256 amount
) internal virtual override {
--snip--
uint256 totalTax = amount.percentMul(baseTax);
uint256 burnAmount = totalTax * burnTaxRate / baseTax;
super._update(from, feeCollector, totalTax - burnAmount);
super._update(from, address(0), burnAmount);
super._update(from, to, amount - totalTax);
}

As a result, the final distributed amounts are less than expected, causing inaccuracies in payments to veRAAC holders and other stakeholders.

Impact

FeeCollector distributions are inaccurate due to RaacToken applying additional fees

Tools Used

vscode

Recommendations

Introduce a safeTransferWithoutFee() function for transfers from feeCollector

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!