Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Access Control Issue in RAACToken Functions

funkornaut

Summary

The RAACToken contract has three functions—setSwapTaxRate, setBurnTaxRate, and setFeeCollector—that are currently restricted to the owner only. However, the RAACMinter contract, which is designed to call these functions, is not the owner. This mismatch causes all such calls from RAACMinter to fail.

Vulnerability Details

setSwapTaxRate, setBurnTaxRate, and setFeeCollector on the RAACToken use the onlyOwner modifier. The RAACMinter is designed to be able to call these functions but is not the owner.

Impact

RAACMinter cannot modify the RAACToken contract as it is designed to do so.

Recommendation

To resolve the issue, modify the access control to allow the RAACMinter to call these functions. This can be done by:

  • Replacing the onlyOwner modifier with onlyMinter, or

  • Creating a new modifier that permits both the owner and the minter to execute these functions.

Example Changes

// For setSwapTaxRate:
- function setSwapTaxRate(uint256 rate) external onlyOwner { _setTaxRate(rate, true); }
+ function setSwapTaxRate(uint256 rate) external onlyMinter { _setTaxRate(rate, true); }
​
// For setBurnTaxRate:
- function setBurnTaxRate(uint256 rate) external onlyOwner { _setTaxRate(rate, true); }
+ function setBurnTaxRate(uint256 rate) external onlyMinter { _setTaxRate(rate, true); }
​
// For setFeeCollector:
- function setFeeCollector(address feeCollector) external onlyOwner { _setFeeCollector(feeCollector, true); }
+ function setFeeCollector(address feeCollector) external onlyMinter { _setFeeCollector(feeCollector, true); }
Conclusion## Vulnerability Details
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter lacks critical ownership transfer functionality and parameter management after receiving RAACToken ownership, causing permanent protocol rigidity

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter lacks critical ownership transfer functionality and parameter management after receiving RAACToken ownership, causing permanent protocol rigidity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!