Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

[M-02] Provided default feeTypes in FeeCollector violate updateFeeType() condition

attentioniayn

Summary

The default values provided in the initialization code violate the constraints set in the updateFeeType() function, namely that they don't sum up to BASIS_POINTS.

Vulnerability Details

If the fee manager successfully updates the feeTypes[6] (Swap Tax) and/or feeTypes[7] (NFT Royalties), they will be unable to go back to the default value since the sum of the FeeType attributes is less than BASIS_POINTS, breaking the condition set by updateFeeType().

Instance 1

Instance 2

Impact

Since it's assumed that the default value is a reasonable choice in the context of the project, this will result in far higher and irreversible fees in case of a mistake in setting them.

Tools Used

Manual review.

Recommendations

Either:

  • remove the BASIS_POINTS requirements from updating the feeTypes

  • scale the shares of feeTypes[6]/[7] and apply the 2% fee on the total via the call to collectFee() instead.

Proof of Code

This snippet of code shows the issue in action.

import { expect } from "chai";
import hre from "hardhat";
const { ethers } = hre;
import { time } from "@nomicfoundation/hardhat-network-helpers";
import { deployContracts } from './utils/deployContracts.js';
​
describe('Exploit Tests', function () {
// Set higher timeout for deployments
this.timeout(300000); // 5 minutes
​
let contracts;
let owner, user1, user2, user3, treasury, repairFund;
const INITIAL_MINT_AMOUNT = ethers.parseEther('1000');
const HOUSE_TOKEN_ID = '1021000';
const HOUSE_PRICE = ethers.parseEther('100');
const ONE_YEAR = 365 * 24 * 3600;
const FOUR_YEARS = 4 * ONE_YEAR;
const BASIS_POINTS = 10000;
​
before(async function () {
[owner, user1, user2, user3, treasury, repairFund] = await ethers.getSigners();
contracts = await deployContracts(owner, user1, user2, user3);
const displayContracts = Object.fromEntries(Object.entries(contracts).map(([key, value]) => [key, value.target]));
console.log(displayContracts);
​
// Set house price for testing
await contracts.housePrices.setHousePrice(HOUSE_TOKEN_ID, HOUSE_PRICE);
​
// Mint initial tokens to users
for (const user of [user1, user2, user3]) {
await contracts.crvUSD.mint(user.address, INITIAL_MINT_AMOUNT);
}
});
​
describe.only('Bugs:', function () {
​
it('[M-02] Provided default feeTypes in FeeCollector violate updateFeeType() condition', async function () {
// Update feeType 6 to a valid setting with a total of BASIS_POINTS
await contracts.feeCollector.connect(owner).updateFeeType(6, {veRAACShare: 10000, burnShare: 0, repairShare: 0, treasuryShare: 0});
​
// Revert to original setting to prove issue
try {
await contracts.feeCollector.connect(owner).updateFeeType(6, {veRAACShare: 500, burnShare: 500, repairShare: 1000, treasuryShare: 0});
} catch (error) {
expect(error.message).to.include('InvalidDistributionParams()');
}
});
});
});
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee shares for fee type 6 and 7 inside FeeCollector do not total up to the expected 10000 basis points, this leads to update problems, moreover they are 10x the specifications

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!