Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Tokens stuck forever in RAACNFT contract

heliosophistxiv

Summary

Users mint RAAC NFTs and pay with crvUSD for the minting process. However, there is no functionality to revert the process (i.e. burn the NFT and withdraw the payment). In addition, there is no functionality to withdraw the money by protocol operators, therefore all payments are stuck forever in the RAACNFT contract.

Vulnerability Details

The RAACNFT contract handles functionality related to RAAC NFTs.

The mint function starts at L32:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

The token used for payment is crvUSD - it is transferred from the minter to the RAACNFT contract by using safeTransferFrom. However, the contract completely lacks functionality to ever withdraw the money, or revert the process, therefore all the money is lost forever in the contract.

Impact

All payments used for minting will forever be stuck in the RAACNFT contract, leading to monetary loss both for users and the protocol.

Tools Used

  • Manual review

Recommendations

Consider implementing the following functionality:

  • Users can revert the minting process

  • Protocol operators can withdraw the funds in case of emergency

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.