Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Users Can Bypass Fee Collection in FeeCollector

cd_pandora

Summary

2025-02-raac/contracts/core/collectors/FeeCollector.sol at main · Cyfrin/2025-02-raac

The collectFee() function at line 162 is an external function that is never enforced within the contract, allowing users to opt-out of paying protocol fees entirely. This prevents revenue generation for veRAAC holders, burning mechanisms, repair funds, and the treasury, ultimately compromising the protocol's sustainability.

Vulnerability Details

The fee collection mechanism relies on the function:

/**
* @notice Collects fees of a specific type
* @param amount Amount of tokens to collect
* @param feeType Type of fee being collected
* @return success True if collection successful
*/
​
function collectFee(uint256 amount, uint8 feeType) external override nonReentrant whenNotPaused returns (bool) {
if (amount == 0 || amount > MAX_FEE_AMOUNT) revert InvalidFeeAmount();
if (feeType > 7) revert InvalidFeeType();
// Transfer tokens from sender
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Update collected fees
_updateCollectedFees(amount, feeType);
emit FeeCollected(feeType, amount);
return true;
}

External Call Without Enforcement

  • This function is never called internally within any deposit, withdrawal, or transaction.

  • Users can simply choose not to call collectFee(), avoiding all protocol fees.

No Automatic Fee Deduction

  • Normally, fees should be deducted from user transactions automatically.

  • Here, the function relies on voluntary user action, making it ineffective.

Impact

Loss of Revenue for Protocol

Tools Used

Recommendations

Automatically Deduct Fees in Transactions:

Modify deposit, borrow, and withdraw functions to automatically call collectFee() when applicable.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!