Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: low
Valid

Fee Type Update Restriction Due to Improper logic for some fee types

Summary

The protocol allows updating of various fee types via the FeeCollector::updateFeeType function. However, there is an issue with the initial configuration of certain fee types (Buy/Sell Swap Tax and NFT Royalty Fees) where their shares sum to less than 100%, which may prevent those fee types from being updated properly. When attempting to update these fee types with values that sum to less than 100%, the validation in the FeeCollector::updateFeeType function triggers a revert, potentially blocking necessary updates.

Vulnerability Details

  1. The FeeCollector::_initializeFeeTypes function initializes specific fee types with share totals that sum to less than 100% (e.g., Buy/Sell Swap Tax and NFT Royalty Fees).
    FeeCollector::_initializeFeeTypes:

function _initializeFeeTypes() internal {
// Protocol Fees: 80% to veRAAC holders, 20% to treasury
feeTypes[0] = FeeType({
veRAACShare: 8000, // 80%
burnShare: 0,
repairShare: 0,
treasuryShare: 2000 // 20%
});
// Lending Fees: Interest income distribution
feeTypes[1] = FeeType({
veRAACShare: 7000, // 70%
burnShare: 0,
repairShare: 0,
treasuryShare: 3000 // 30%
});
// Performance Fees: 20% from yield products
feeTypes[2] = FeeType({
veRAACShare: 6000, // 60%
burnShare: 0,
repairShare: 0,
treasuryShare: 4000 // 40%
});
// Insurance Fees: 3% from NFT loans
feeTypes[3] = FeeType({
veRAACShare: 5000, // 50%
burnShare: 0,
repairShare: 2000, // 20%
treasuryShare: 3000 // 30%
});
// Mint/Redeem Fees
feeTypes[4] = FeeType({
veRAACShare: 6000, // 60%
burnShare: 0,
repairShare: 2000, // 20%
treasuryShare: 2000 // 20%
});
// Vault Fees
feeTypes[5] = FeeType({
veRAACShare: 7000, // 70%
burnShare: 0,
repairShare: 0,
treasuryShare: 3000 // 30%
});
// Buy/Sell Swap Tax (2% total)
@> feeTypes[6] = FeeType({
@> veRAACShare: 500, // 0.5%
@> burnShare: 500, // 0.5%
@> repairShare: 1000, // 1.0%
@> treasuryShare: 0
@> });
// NFT Royalty Fees (2% total)
@> feeTypes[7] = FeeType({
@> veRAACShare: 500, // 0.5%
@> burnShare: 0,
@> repairShare: 1000, // 1.0%
@> treasuryShare: 500 // 0.5%
@> });
}

2.The FeeCollector::updateFeeType function checks that the sum of the shares (veRAACShare, burnShare, repairShare, treasuryShare) for a fee type must equal 100% (BASIS_POINTS).
FeeCollector::updateFeeType:

function updateFeeType(uint8 feeType, FeeType calldata newFee) external override {
if (!hasRole(FEE_MANAGER_ROLE, msg.sender)) revert UnauthorizedCaller();
if (feeType > 7) revert InvalidFeeType();
// Validate fee shares total to 100%
@> if (newFee.veRAACShare + newFee.burnShare + newFee.repairShare + newFee.treasuryShare != BASIS_POINTS) {
@> revert InvalidDistributionParams();
@> }
feeTypes[feeType] = newFee;
emit FeeTypeUpdated(feeType, newFee);
}

3.If the sum of shares does not equal 100%, the function reverts with the InvalidDistributionParams() error.

4. This validation prevents updating the fee types (Buy/Sell Swap Tax and NFT Royalty Fees) because their initial sums are less than 100%, creating a scenario where legitimate updates are blocked.

Impact

  1. Fee types like Buy/Sell Swap Tax and NFT Royalty Fees may become immutable or stuck in a state where they cannot be updated to proper values.

  2. The inability to update fee types could limit flexibility in adjusting protocol fees and prevent necessary updates or corrections.

Tools Used

Manual

Recommendations

Modify the validation in updateFeeType() to allow fee types initialized with less than 100% to be updated appropriately, without blocking legitimate changes.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee shares for fee type 6 and 7 inside FeeCollector do not total up to the expected 10000 basis points, this leads to update problems, moreover they are 10x the specifications

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.