Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

RAACReleaseOrchestrator::emergencyRevoke Transfers Funds to Contract Instead of Beneficiary, Leading to Permanent Lock

zebra

Summary

RAACReleaseOrchestrator::emergencyRevoke send RAACToken to wrong address.

Vulnerability Details

The function RAACReleaseOrchestrator::emergencyRevoke is intended to allow emergency revocation of tokens, transferring them to the intended beneficiary. However, due to an incorrect transfer target, the function mistakenly sends the tokens to the RAACReleaseOrchestrator contract itself instead of the designated beneficiary.

Since RAACReleaseOrchestrator does not have the functionality to transfer or withdraw RAACToken after the transfer, the tokens become permanently locked within the contract, making them inaccessible to the intended recipient.

function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
...
if (unreleasedAmount > 0) {
raacToken.transfer(address(this), unreleasedAmount);
emit EmergencyWithdraw(beneficiary, unreleasedAmount);
}
...
}

Impact

  1. The emergency revoke function fails to release the intended tokens.

  2. Tokens are permanently locked within the contract, rendering them unrecoverable.

  3. Affected users will experience an irreversible loss of their assets.

Tools Used

N/A

Recommendations

change parameter address(this) to beneficiary

function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
...
if (unreleasedAmount > 0) {
- raacToken.transfer(address(this), unreleasedAmount);
+ raacToken.transfer(beneficiary, unreleasedAmount);
emit EmergencyWithdraw(beneficiary, unreleasedAmount);
}
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.