Core Contracts

Summary

The FeeCollector contract incorrectly allocates remaining fees from the Buy/Sell Swap Tax (feeType 6) and NFT Royalty Fees (feeType 7) to the treasury, despite the intended design that specifies 0% should go to the treasury from these fee types. This misallocation can lead to confusion and undermine the protocol's intended fee distribution structure.

Vulnerability Details

1. Fee Distribution Logic: The current implementation allows for the calculation of shares for various fee types, including the treasury share. However, the logic incorrectly adds any remaining fees to the treasury share, which contradicts the intended allocation.

Example Scenario

1. Collecting Fees:

   • Total fees collected from feeType 6 (Buy/Sell Swap Tax) = 1000 tokens.

   • Fee distribution:

     • veRAACShare: 500 (5%)

     • burnShare: 500 (5%)

     • repairShare: 1000 (10%)

     • treasuryShare: 0 (0%)

2. Distributing Collected Fees:

   • When distributeCollectedFees is called, the calculated shares would be:

     • shares[0] (veRAACShare) = (1000 * 500) / 10000 = 50 tokens

     • shares[1] (burnShare) = (1000 * 500) / 10000 = 50 tokens

     • shares[2] (repairShare) = (1000 * 1000) / 10000 = 100 tokens

     • shares[3] (treasuryShare) = (1000 * 0) / 10000 = 0 tokens

3. Calculating Remainder:

   • Total shares = 50 + 50 + 100 + 0 = 200 tokens.

   • Remainder = totalFees - total shares = 1000 - 200 = 800 tokens.

4. Incorrect Allocation to Treasury:

   • The remainder (800 tokens) is incorrectly added to shares[3] (the treasury share), resulting in:

     • shares[3] = 800 tokens.

   • This allocation contradicts the intended design where 0% should go to the treasury from feeType 6.

Impact

This vulnerability can lead to significant misallocation of funds, as the treasury receives tokens that were not intended for it. Moreover, the funds are sent to the treasury via safeTransferFrom() instead of deposit(), so the funds are unrecoverable.

Recommendations

1Adjust Fee Distribution Logic: Modify the logic in the distributeCollectedFees function to ensure that any excess funds from feeType 6 and feeType 7 are not allocated to the treasury. Instead, consider burning these excess tokens or handling them according to the protocol's intended design.