Core Contracts

Summary

Some OnlyOwner functions cannot be called.

Vulnerability Details

The setBurnTaxRate allow Updater_ROLE to set the burn tax rate of the raacToken

This implementation tells us that the owner of the RacctToken contract is the RaacMinters because the setBurnTaxRate of the raact token contract has an onlyOwner modifier.

An issue with this is that, functions like manageWhitelist and the settaxRateincrementLimit requires the same onlyOwner to call them, but there's no call for such functions from the raacMinters contract, this will mean that the functions cannot be called to add or remove whitelist or to set tax rate increment limit.

Impact

Whitelist cannot be added nor be removed, and also the taxRateIncrementLimit cannot be set.

Tools Used

Manual review

Recommendations

Call these functions from the raacMinters ( the owner)