Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

The RepairFundUpdated and TreasuryUpdated events are emitted when they have not been updated yet.

meeve

Summary

RepairFundUpdated and TreasuryUpdated event are emitted, when admin is updating pendingTreasury or pendingRepairFund, but then another day has to pass in order to actually update these.

Vulnerability Details

// FeeCollector.sol 253
​
function setRepairFund(address newRepairFund) external override {
if (!hasRole(DEFAULT\_ADMIN\_ROLE, msg.sender)) revert UnauthorizedCaller();
if (newRepairFund == address(0)) revert InvalidAddress();
pendingRepairFund = PendingUpdate({
newAddress: newRepairFund,
effectiveTime: block.timestamp + TREASURY_UPDATE_DELAY
});
// Event
emit RepairFundUpdated(newRepairFund);
}
​
// FeeCollector.sol 237
​
function setTreasury(address newTreasury) external override {
if (!hasRole(DEFAULT_ADMIN_ROLE, msg.sender)) revert UnauthorizedCaller();
if (newTreasury == address(0)) revert InvalidAddress();
pendingTreasury = PendingUpdate({
newAddress: newTreasury,
effectiveTime: block.timestamp + TREASURY_UPDATE_DELAY
});
​
// Event
emit TreasuryUpdated(newTreasury);
}

Impact

It incorrectly states that the treasury or recovery fund has been updated, but this will happen in a day or so. Admin might also update one of these, before that one day, so another event would be emitted, while original treasury of repair fund was never actualy in use.

Tools Used

Manual Review

Recommendations

TreasuryUpdated should be emitted once applyTreasuryUpdate is completed and FeeTypeUpdated when applyRepairFundUpdate is done. Or these event should inform that those events are about to happen.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!