Core Contracts

Summary

In the mint function in RAACNFT.sol The contract receives ERC20 tokens but has no function to withdraw them. This means the contract owner cannot remove funds, causing permanent loss of tokens inside the contract.

Vulnerability Details

Impact

1. The contract owner cannot remove funds

2. Permanent loss of tokens inside the contract

Attack Scenario:

1. Users continuously mint NFTs, sending ERC20 tokens to the contract.

2. Since there's no function to withdraw tokens, the funds remain stuck.

3. If the owner needs the funds for operational expenses or liquidity management, they cannot access them.

Proof of Concept (PoC)

Scenario: Contract Accumulates ERC20 Tokens

mint(1, 100); // User transfers 100 ERC20 tokens
mint(2, 150); // Another user transfers 150 ERC20 tokens

// Contract balance now holds 250 tokens, but...````// There is no function to withdraw them.

Now, all ERC20 tokens are permanently locked, making it impossible for the contract to use or distribute them.

Tools Used

manual review

Recommendations

Add a withdraw function to allow the owner to retrieve ERC20 tokens

}