Core Contracts

Impact

When the feeCollector is set to address(0) (disabling fee collection), the burn function still deducts a taxAmount from the user’s specified burn amount but fails to handle the taxAmount properly. Instead of burning the full amount, the function only burns amount - taxAmount, leaving the taxAmount in the user’s balance. This results in:

1. Incomplete Burning: Users unintentionally retain taxAmount tokens in their balance, contrary to their expectation of burning the full amount.

2. Funds Mismanagement: The unburned taxAmount remains in the user’s account, where it's intended to burnt

Proof of Concept

Affected Code

Burn Function

Link to Code

Issue Demonstration

1. Scenario:

   • feeCollector = address(0) (fee collection disabled).

   • User calls burn(100) with burnTaxRate = 50 (0.5%).

2. Outcome:

   • taxAmount = 100 * 0.5% = 0.5.

   • _burn(msg.sender, 99.5) reduces the user’s balance by 99.5.

   • The taxAmount (0.5) is not sent to feeCollector (since feeCollector is address(0)).

   • The user retains 0.5 tokens in their balance, despite intending to burn 100.

3. Contradiction:
   The documentation states that disabling the feeCollector should make transactions tax-free. However, the burn function still applies a tax, leading to incomplete burning.

Tools Used

• Manual code review

Recommended Mitigation Steps

Modify the burn function to skip tax calculation entirely when feeCollector is address(0), ensuring the full amount is burned:

Updated Burn Function

Explanation

• Tax-Free Burning: When feeCollector is address(0), taxAmount is set to 0, and the entire amount is burned.