Core Contracts

Summary

The emergencyRevoke function in the RAACReleaseOrchestrator contract is designed to revoke a beneficiary's vesting schedule and transfer any unreleased RAAC tokens back to the contract itself (address(this)). However, this design is suboptimal for an emergency operation. In an emergency scenario, the unreleased tokens should be transferred to a secure address (e.g., the caller or a designated safe address) rather than being left in the contract. This ensures that the tokens can be quickly recovered and managed appropriately.

Vulnerability Details

The emergencyRevoke function transfers unreleased RAAC tokens to the contract itself (address(this)):

In an emergency, the primary goal is to quickly recover and secure the tokens. The unreleased tokens should be transferred to a secure address, such as the caller (msg.sender) or a designated safe address. Leaving the tokens in the contract could lead to operational inefficiencies or even loss of funds if the contract is compromised or becomes non-functional.

Impact

• Operational Inefficiency: Tokens left in the contract may require additional steps or permissions to recover, delaying the emergency response.

• Security Risks: If the contract is compromised or becomes non-functional, the tokens may become inaccessible or lost.

• Misalignment with Emergency Intent: The current design does not align with the intent of an emergency operation, which is to quickly secure the tokens.

The impact is Low, the likelihood is Medium, so the severity is Low.

Tools Used

Manual Review

Recommendations

Consider following fix: