Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`_setTaxRate` check could be compromised

ChainDefenders

Summary

In RAACToken:setTaxRate, the function checks if the change in tax rate is too large. However, an admin can repeatedly call this function to bypass the restriction.

function _setTaxRate(uint256 newRate, bool isSwapTax) private {
if (newRate > MAX_TAX_RATE) revert TaxRateExceedsLimit();
​
uint256 currentRate = isSwapTax ? swapTaxRate : burnTaxRate;
​
if (currentRate != 0) {
uint256 maxChange = currentRate.percentMul(taxRateIncrementLimit);
// Check if the new rate is too high (newRate > currentRate + maxChange) or too low (newRate < currentRate && currentRate - newRate > maxChange) by more than the allowed increment
bool isTooHighOrTooLow = newRate > currentRate + maxChange ||
(newRate < currentRate && currentRate - newRate > maxChange);
​
if (isTooHighOrTooLow) {
revert TaxRateChangeExceedsAllowedIncrement();
}
}
​
if (isSwapTax) {
swapTaxRate = newRate;
emit SwapTaxRateUpdated(newRate);
} else {
burnTaxRate = newRate;
emit BurnTaxRateUpdated(newRate);
}
}

Vulnerability Details

Scenario:

  1. The tax rate update is restricted to incremental changes.

  2. An admin can bypass this restriction by calling the function multiple times in succession.

  3. This effectively allows drastic tax rate changes, negating the intended limit.

Impact

The tax rate restriction mechanism is ineffective as an admin can manipulate the system to exceed the intended limit over multiple transactions. This could lead to unfair taxation and unexpected changes for users.

Tools Used

Manual review

Recommendations

  • Implement a time-based mechanism to enforce a cooldown period between tax rate changes.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.