Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Revenue Accounting Failure

kwakudr

Summary

The distributeRevenue() function splits revenue into two parts (80% to veRAAC holders, 20% as performance fees) but only processes the 80% share. The 20% performance fee is emitted in an event but never stored or distributed

Vulnerability Details

function distributeRevenue(
GaugeType gaugeType,
uint256 amount
) external onlyRole(EMERGENCY_ADMIN) whenNotPaused {
if (amount == 0) revert InvalidAmount();
uint256 veRAACShare = amount * 80 / 100; // 80% to veRAAC holders
uint256 performanceShare = amount * 20 / 100; // 20% performance fee
revenueShares[gaugeType] += veRAACShare;
_distributeToGauges(gaugeType, veRAACShare);
emit RevenueDistributed(gaugeType, amount, veRAACShare, performanceShare);
}
uint256 veRAACShare = amount * 80 / 100; // 80% to veRAAC holders
uint256 performanceShare = amount * 20 / 100; // 20% performance fee
​
revenueShares[gaugeType] += veRAACShare; // Only 80% is tracked
_distributeToGauges(gaugeType, veRAACShare); // Only 80% is distributed
​
// 20% performanceShare is emitted but not stored/used
emit RevenueDistributed(gaugeType, amount, veRAACShare, performanceShare);

The contract loses track of 20% of the revenue. The performanceShare is neither:

  • Stored in the performanceFees mapping (declared but unused).

  • Distributed to any address/contract.

  • Burned or otherwise accounted for.

Impact

The 20% performanceShare remains in the contract but is not accessible. The total distributed amount (veRAACShare + performanceShare) exceeds the actual transferred amount (veRAACShare alone)

Tools Used

Foundry

Recommendations

Store or Distribute Performance Fees

// Add this line to track performance fees
performanceFees[msg.sender] += performanceShare;
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!