Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Fee mismatch in FeeCollector::_initializeFeeTypes()

newspacexyz

Summary

The FeeCollector#_initializeFeeTypes() manually assigns fee distribution values without enforcing sum validation.

Vulnerability Details

  • The fee allocation does not always add up to BASIS_POINTS (10000).

  • The comment descriptions misrepresent actual allocated percentages.

  • This bypasses the validation check present in updateFeeType().

function _initializeFeeTypes() internal {
...
// Buy/Sell Swap Tax (2% total)
feeTypes[6] = FeeType({
veRAACShare: 500, // 0.5% //@audit Actually 5%
burnShare: 500, // 0.5%
repairShare: 1000, // 1.0%
treasuryShare: 0
});
// NFT Royalty Fees (2% total)
feeTypes[7] = FeeType({
veRAACShare: 500, // 0.5%
burnShare: 0,
repairShare: 1000, // 1.0%
treasuryShare: 500 // 0.5%
});
}

In feeTypes[7], the treasury share is set to 500, but _calculateDistribution() derives it as 8500 in _calculateDistribution(), creating an 8000 basis point discrepancy.

function _calculateDistribution(uint256 totalFees) internal view returns (uint256[4] memory shares) {
...
​
uint256 remainder = totalFees - (shares[0] + shares[1] + shares[2] + shares[3]);
@> if (remainder > 0) shares[3] += remainder;
}

In feeTypes[6], sum of shares is not equal to 10000, causing unintended fund allocations.

Impact

Incorrect Reward Calculations

Treasury may receive more or fewer funds than intended.

Tools Used

manual

Recommendations

Modify _initializeFeeTypes() to use updateFeeType() instead of direct assignment.

Fix wrong comments.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee shares for fee type 6 and 7 inside FeeCollector do not total up to the expected 10000 basis points, this leads to update problems, moreover they are 10x the specifications

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.