[M-03] RAACMinter cannot disable the fees managed by RAACToken
Summary
Transfer and burn fees from operations with RAACToken cannot be easily disabled via setFeeCollector.
Vulnerability Details
Assuming that RAACMinter is correctly setup to be the owner of RAACToken as the code implies, the problem is that the setFeeCollector() function in RAACMinter excludes address(0) from the valid inputs, but this is the intended input to give to the setFeeCollector() in RAACToken.
Impact
This results in the burn and transfer fees being always active, while the code suggests the possibility of disabling them at the owner's discretion.
Tools Used
Manual review.
Recommendations
Remove the revert on address(0) from setFeeCollector() in RAACMinter.
Lead Judging Commences
RAACMinter::setFeeCollector prevents disabling fees by blocking zero address assignment
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.