Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

unused emergency flag in `veRAACToken` contract, prevent users from withdrawing

maa_ly

Summary

Unused Emergency Unlock Flag. The contract has a flag emergencyUnlockEnabled, which is set by an admin. But looking at the withdraw function, it only checks if the lock has expired or if emergencyWithdrawDelay has passed. There's no check for emergencyUnlockEnabled. So even if the admin enables emergency unlock, the regular withdraw function still requires the lock to be expired. That means the emergency unlock feature is effectively useless. Users can't withdraw during an emergency unless the admin sets up a separate function, which doesn't exist. This renders the emergency mechanism non-functional, which is a big problem .

Vulnerability Details

State transition logic lacks integration with emergency systems:

bool public emergencyUnlockEnabled; // Never checked in withdraw()
​
function withdraw() {
require(block.timestamp >= lock.end); // Standard check remains
// No emergencyUnlockEnabled conditional
}

PoC

function testEmergencyUnlock_NoEffect() public {
address alice = makeAddr("alice");
uint256 someAmount = 200e18;
deal(alice, someAmount);
vm.prank(owner);
mockraac.mintTo(alice, someAmount);
// Setup lock
​
vm.startPrank(alice);
mockraac.approve(address(raacToken), 100e18);
raacToken.lock(100e18, 365 days);
vm.stopPrank();
​
// Enable emergency unlock
vm.prank(address(this));
// raacToken.withEmergencyDelay();
raacToken.scheduleEmergencyUnlock();
vm.warp(block.timestamp + 3 days);
raacToken.executeEmergencyUnlock();
​
// Try early withdrawal
vm.prank(alice);
raacToken.withdraw(); // Still reverts with "LockNotExpired"
}
​

Impact

Fund Lockup: Users cannot retrieve assets during legitimate emergencies

Tools Used

manual review, foundry

Recommendations

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::executeEmergencyUnlock is dormant, it configures a system that's never used

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!