Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`RAACNFT` contract cannot send `crvUSD` back to `Seller`

shuernchua

Summary

In the Contest Details, the Seller is a company or person that sells the RAACNFT for crvUSD.

However, the RAACNFT contract has no withdrawal function to transfer the crvUSD out of the contract to any other address, including the Seller's wallet. Hence, all payment for all RAACNFT will be stuck.

Vulnerability Details

The mint() function is as follows:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

Since the crvUSD token transferred to the RAACNFT contract via token.safeTransferFrom(msg.sender, address(this), _amount);, the crvUSD will be transferred to the contract address.

Impact

crvUSD is stuck in the RAACNFT contract, and the Seller cannot use it in any way.

Tools Used

Manual Review

Recommendations

Consider adding a function to withdraw funds.

function withdrawTokens(address _to, uint256 _amount) external onlyOwner {
if (_to == address(0)) revert RAACNFT__InvalidAddress();
if (_amount == 0) revert RAACNFT__InvalidAmount();
if (_amount > token.balanceOf(address(this))) revert RAACNFT__InsufficientFunds();
​
token.safeTransfer(_to, _amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.