Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Burn Tax Handling When feeCollector is Disabled

kwakudr

Summary

Burning amount tokens should reduce the caller’s balance by the full amount (including taxes) but the code does not implement this when feeCollector is set to address(0).

Vulnerability Details

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
_burn(msg.sender, amount - taxAmount);
if (taxAmount > 0 && feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount);
}
}

When feeCollector is set to address(0), the burn function deducts only amount - taxAmount from the user’s balance, leaving taxAmount unburned. This violates the expectation that burn(amount) destroys the full amount of tokens.

Step 1: Calculate taxAmount (e.g., 0.5% of amount).

Step 2: Burn amount - taxAmount from the user’s balance.

Step 3: If feeCollector is set, transfer taxAmount to it. If feeCollector == address(0), do nothing with taxAmount.

Impact

The original code failed to handle taxAmount when feeCollector was disabled, leaving residual tokens in the user’s balance.

Tools Used

Foundry

Recommendations

Modify the burn function to burn taxAmount if feeCollector is disabled:

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
_burn(msg.sender, amount - taxAmount);
if (taxAmount > 0) {
if (feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount);
} else {
_burn(msg.sender, taxAmount); // Burn tax if no feeCollector
}
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn incorrectly deducts tax amount but doesn't burn or transfer it when feeCollector is address(0), preventing complete token burns

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn incorrectly deducts tax amount but doesn't burn or transfer it when feeCollector is address(0), preventing complete token burns

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!