Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Protocol Violation in `RAACReleaseOrchestrator::categoryAllocations` – Exceeds 65% Cap and Allows Post-Deployment Modifications

zgczgc

Summary

The RAACReleaseOrchestrator::categoryAllocations implementation violates protocol design specifications in two critical aspects:

  1. Total Allocation Overflow: Initial allocation sum reaches 65.1% (exceeding 65% cap)

  2. Post-Deployment Mutability: updateCategoryAllocation function enables unauthorized post-deployment modifications

Vulnerability Details

constructor(address _raacToken) {
if (_raacToken == address(0)) revert InvalidAddress();
raacToken = IRAACToken(_raacToken);
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(ORCHESTRATOR_ROLE, msg.sender);
_grantRole(EMERGENCY_ROLE, msg.sender);
// Initialize category allocations
categoryAllocations[TEAM_CATEGORY] = 18_000_000 ether; // 18%
categoryAllocations[ADVISOR_CATEGORY] = 10_300_000 ether; // 10.3%
categoryAllocations[TREASURY_CATEGORY] = 5_000_000 ether; // 5%
categoryAllocations[PRIVATE_SALE_CATEGORY] = 10_000_000 ether;// 10%
categoryAllocations[PUBLIC_SALE_CATEGORY] = 15_000_000 ether; // 15%
categoryAllocations[LIQUIDITY_CATEGORY] = 6_800_000 ether; // 6.8% (5.8% + 1%) <==@found
}
​
function updateCategoryAllocation( <==@found
bytes32 category,
uint256 newAllocation
) external onlyRole(DEFAULT_ADMIN_ROLE) {
if (categoryAllocations[category] == 0) revert InvalidCategory();
if (newAllocation < categoryUsed[category]) revert InvalidAmount();
categoryAllocations[category] = newAllocation;
emit CategoryAllocationUpdated(category, newAllocation);
}

Impact

  • Violation of Design Requirements:Exceeds 65% allocation limit

  • Violation of Design Requirements: Unauthorized post-deployment modifications may lead to unpredictable risks.

Tools Used

  • Manual Review

Recommendations

  • 1.Remove the RAACReleaseOrchestrator::updateCategoryAllocation function.

  • 2.Modify the RAACReleaseOrchestrator::constructor to ensure the sum of categoryAllocations is 65%.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!