Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

RAAC token will be locked in RAACReleaseOrchestrator in emergency

x1485967

Summary

RAAC token will be locked in RAACReleaseOrchestrator in emergency

Vulnerability Details

In RAACReleaseOrchestrator, the owner will transfer some RAAC tokens and distribute these RAAC tokens to the users. When there is something wrong, the EMERGENCY_ROLE can pause the contract and revoke these vesting schedule.

In function emergencyRevoke(), we will delete vestingSchedules and transfer the RAAC token out of the contract. The problem here is that we set the destination address is address(this). It means that all RAAC tokens will be locked in the contract.

For example:

  1. The ORCHESTRATOR_ROLE create one vesting schedule for Alice, the amount is 1000 RAAC token.

  2. The owner transfers 1000 RAAC token into RAACReleaseOrchestrator.

  3. When we want to revoke Alice's vesting schedule, the 1000 RAAC will be stuck in this contract.

function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 unreleasedAmount = schedule.totalAmount - schedule.releasedAmount;
delete vestingSchedules[beneficiary];
if (unreleasedAmount > 0) {
raacToken.transfer(address(this), unreleasedAmount);
emit EmergencyWithdraw(beneficiary, unreleasedAmount);
}
}

Impact

Some RAAC token will be stuck in the contract.

Tools Used

Manual

Recommendations

In emergencyRevoke(), we should assign one user to receive these RAAC tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!