Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unenforced Total Tax Cap

kwakudr

Summary

The contract allows the total tax (swap + burn) to exceed the intended maximum of 10% (1000 basis points). While individual tax rates (swapTaxRate and burnTaxRate) are capped at 10% each, their sum can reach 20%, violating the invariant that total taxes should not exceed 10%

Vulnerability Details

contract RAACToken is ERC20, Ownable, IRAACToken {
using PercentageMath for uint256;

uint256 public swapTaxRate = 100; // 1% swap tax (100 basis points)
uint256 public burnTaxRate = 50; // 0.5% burn tax (50 basis points)
address public feeCollector;
address public minter;
​
​
uint256 public constant MAX_TAX_RATE = 1000; // 10%
uint256 public constant BASE_INCREMENT_LIMIT = 1000; // 10% in basis points
uint256 public taxRateIncrementLimit = BASE_INCREMENT_LIMIT;
​
​
mapping(address => bool) public whitelistAddress;
​
​
modifier onlyMinter() {
if (msg.sender != minter) revert OnlyMinterCanMint();
_;
}
​
​
/**
* @dev Constructor that initializes the RAAC token
* @param initialOwner The address of the initial owner
* @param initialSwapTaxRate The initial swap tax rate (in basis points)
* @param initialBurnTaxRate The initial burn tax rate (in basis points)
*/
constructor(
address initialOwner,
uint256 initialSwapTaxRate,
uint256 initialBurnTaxRate
) ERC20("RAAC Token", "RAAC") Ownable(initialOwner) {
if (initialOwner == address(0)) revert InvalidAddress();
feeCollector = initialOwner;
if (initialSwapTaxRate > MAX_TAX_RATE) revert SwapTaxRateExceedsLimit();
swapTaxRate = initialSwapTaxRate == 0 ? 100 : initialSwapTaxRate; // default to 1% if 0
emit SwapTaxRateUpdated(swapTaxRate);
if (initialBurnTaxRate > MAX_TAX_RATE) revert BurnTaxRateExceedsLimit();
burnTaxRate = initialBurnTaxRate == 0 ? 50 : initialBurnTaxRate; // default to 0.5% if 0
emit BurnTaxRateUpdated(burnTaxRate);
}

The constructor validates individual rates but not their sum. For example:

initialSwapTaxRate = 10%, initialBurnTaxRate = 10% → total tax = 20%.

When updating a tax rate, the contract ensures the new rate is ≤ 10% but does not check the combined total with the other rate.

If swapTaxRate = 10% and burnTaxRate = 10%, totalTax = 20%.

Impact

The original code allowed the total tax to exceed the intended 10% cap by not validating the sum of swapTaxRate and burnTaxRate. This will squeeze users of the contract to pay higher than intended.

Tools Used

Foundry

Recommendations

Enforce a total tax cap by checking swapTaxRate + burnTaxRate ≤ MAX_TAX_RATE in the constructor and _setTaxRate

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!