Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Unreachable rescueToken Function in RToken Contract

bshyuunn

01. Relevant GitHub Links

02. Summary

The rescueToken function in the RToken contract is restricted by the onlyReservePool modifier, implying it can only be called by the ReservePool. However, since the ReservePool contract does not implement any function to invoke rescueToken, this functionality is effectively unavailable. Consequently, _assetAddress tokens sent to the RToken contract cannot be rescued.

03. Vulnerability Details

The rescueToken function, designed to retrieve mistakenly sent tokens (except for the main asset), is never actually callable because there is no code path in the ReservePool contract to execute it. Although the onlyReservePool modifier intends to restrict usage, it also prevents legitimate rescue attempts, as the ReservePool lacks an interface or function to trigger this rescue.

/**
* @notice Rescue tokens mistakenly sent to this contract
* @dev Only callable by the Reserve Pool. Cannot rescue the main asset.
* @param tokenAddress The address of the ERC20 token
* @param recipient The address to send the rescued tokens to
* @param amount The amount of tokens to rescue
*/
function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyReservePool {
if (recipient == address(0)) revert InvalidAddress();
if (tokenAddress == _assetAddress) revert CannotRescueMainAsset();
IERC20(tokenAddress).safeTransfer(recipient, amount);
}

04. Impact

Tokens that are mistakenly transferred to RToken remain irretrievable, limiting recovery options.

05. Tools Used

Manual Code Review and Foundry

06. Recommended Mitigation

Implement a function in the ReservePool that can invoke rescueToken

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::rescueToken() can never be called

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.