Core Contracts

Summary

The protocol has defined fixed token allocations through RAACReleaseOrchestrator totaling 65.1M RAAC tokens, which represents 65% of total supply. However, there is no maximum supply cap enforced in the RAACToken contract, and continuous emissions through RAACMinter can dilute these allocations indefinitely. This misalignment between fixed allocations and uncapped supply undermines the intended tokenomics model.

Vulnerability Details

The issue stems from three interacting components:
The RAACReleaseOrchestrator contract defines fixed token allocations totaling 65.1M RAAC tokens:

Team: 18M RAAC
Advisors: 10.3M RAAC
Treasury: 5M RAAC
Private Sale: 10M RAAC
Public Sale: 15M RAAC
Liquidity: 6.8M RAAC

These allocations appear to be based on an assumed total supply of 100M tokens (as 65.1M represents approximately 65%). However, RAACToken lacks any supply cap mechanism, and RAACMinter can continuously emit new tokens at rates between 100-2000 RAAC per day through its dynamic emissions schedule.
While RAACMinter has controls for emission rates, there is no lifetime cap on total emissions. The minting function in RAACToken only checks that the caller is the authorized minter:

Impact

Medium - Token Dilution: The fixed allocations of 65.1M tokens will represent an ever-decreasing percentage of total supply as new tokens are minted, undermining the intended 65/35 distribution model.

Likelihood

Low - Assuming a maximum emission rate of 2000 RAAC/day, it would take ~48 years to reach this imbalance point, thus likelihood is low.

Recommendations

Implement Supply Cap