Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of Token Withdrawal Mechanism in RAACNFT Contract

bshyuunn

01. Relevant GitHub Links

02. Summary

When users mint an NFT by paying an appropriate token amount, the RAACNFT contract receives and holds these tokens. However, there is no mechanism to withdraw these tokens from the contract.

03. Vulnerability Details

The mint function transfers ERC20 tokens from the user to the RAACNFT contract.

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
@> token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

Since the contract lacks a function to withdraw or transfer these funds out, the assets remain locked within the contract indefinitely.

04. Impact

Tokens paid for NFT purchases are permanently inaccessible once transferred to the contract, resulting in locked liquidity and potential financial loss.

05. Tools Used

Manual Code Review and Foundry

06. Recommended Mitigation

Implement a withdrawal function or mechanism allowing the contract owner (or other authorized entity) to transfer out any ERC20 tokens held by the contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.