Summary

The FeeCollector contract includes a function updateFeeType that allows the FEE_MANAGER_ROLE to update fee type parameters. These parameters determine how collected fees are distributed among various stakeholders (veRAAC holders, treasury, repair fund, and token burning). Although the function enforces that the sum of these parameters equals 100% (using BASIS_POINTS, where 100% = 10000), it does not impose any restrictions on individual fee allocations.

Vulnerability Details

The updateFeeType function is implemented as follows:

Because the only constraint is that the fee shares sum to 100% (i.e., BASIS_POINTS), a fee manager can set extreme values. For example, the fee manager could configure:

• veRAACShare = 0

• burnShare = 10000

• repairShare = 0

• treasuryShare = 0

This configuration passes the validation but results in all collected fees being allocated exclusively to burnShare**** while starving other critical components of the ecosystem, such as the treasury, repair fund, and veRAACShare.

Impact

Unbalanced fee distribution

Tools Used

Manual Review

Recommendations

Enforce minimum allocations for critical fee types to ensure that none of these are set to zero.