Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

whitelisted user will incorrectly be charged burn tax because condition to check is absence

bobai23

Summary

In RAACToken.sol contract

Vulnerability Details

In RAACToken.sol contract in _update function in comment section mention that -> // Skip tax for whitelisted addresses or when fee collector disabled

function _update(//@audit revisit it
address from,
address to,
uint256 amount
) internal virtual override {
uint256 baseTax = swapTaxRate + burnTaxRate;
// Skip tax for whitelisted addresses or when fee collector disabled
if (baseTax == 0 || from == address(0) || to == address(0) || whitelistAddress[from] || whitelistAddress[to] || feeCollector == address(0)) {
super._update(from, to, amount);
return;
}
​
// All other cases where tax is applied
uint256 totalTax = amount.percentMul(baseTax);
uint256 burnAmount = totalTax * burnTaxRate / baseTax;
super._update(from, feeCollector, totalTax - burnAmount);
super._update(from, address(0), burnAmount);
super._update(from, to, amount - totalTax);
}

In burn function you can observe there is no cheking that msg.sender is whitelisted or not ?

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
_burn(msg.sender, amount - taxAmount);
if (taxAmount > 0 && feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount);
}
}

So In conclusion there is no special discount for whitelisted user of burning tax { as mention in comment section }.

Impact

whitelisted user will incorrectly be charged a burn tax according comment section of _update function.

Tools Used

Manual Review

Recommendations

In RAACToken.sol contract In burn function modify according below things...

function burn(uint256 amount) external {
@>> uint256 taxAmount = 0;
// Only apply tax if the caller is not whitelisted
@>> if (!whitelistAddress[msg.sender]) {
taxAmount = amount.percentMul(burnTaxRate);
}
​
_burn(msg.sender, amount - taxAmount);
​
if (taxAmount > 0 && feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!