Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

No withdrawal tokens mechanism in RAACNFT

newspacexyz

Summary

The RAACNFT contract allows users to mint NFTs by transferring ERC20 tokens. However, there is no function to withdraw or use these funds, causing them to be permanently locked in the contract.

Vulnerability Details

In RAACNFT#mint(), users send ERC20 tokens (_amount) to the RAACNFT contract:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
@> token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

However, there is no function to withdraw or manage the accumulated tokens.

As a result, all tokens for minted NFTs will be locked in the contract forever.

Impact

Funds for minted NFTs are permanently locked

Tools Used

manual

Recommendations

Add a withdraw function to allow the contract owner to transfer funds to a treasury or operational wallet.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!