Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Fees from RAAC transfers are lost

OpaBatyo

Summary

All fees gathered from RAAC._update are incorrectly sent to the FeeCollector contract and lost forever.

Details

FeeCollector has a specific method to deposit fees in order to account for them internally to a specific feeType

function collectFee(uint256 amount, uint8 feeType) external override nonReentrant whenNotPaused returns (bool) {
if (amount == 0 || amount > MAX_FEE_AMOUNT) revert InvalidFeeAmount();
if (feeType > 7) revert InvalidFeeType();
​
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Update collected fees
@>> _updateCollectedFees(amount, feeType);
emit FeeCollected(feeType, amount);
return true;
}

This is important since totalFee calculations are done by summing each amount for every feeType

function _calculateTotalFees() internal view returns (uint256) {
return collectedFees.protocolFees +
collectedFees.lendingFees +
collectedFees.performanceFees +
collectedFees.insuranceFees +
collectedFees.mintRedeemFees +
collectedFees.vaultFees +
collectedFees.swapTaxes +
collectedFees.nftRoyalties;
}

If a fee had not been accounted for through collectFees towards a specific feeType, it will not be sent when distributeCollectedFees is invoked. Currently, fees from RAAC transfers are directly sent via _update instead of calling the collectFees method.

super._update(from, feeCollector, totalTax - burnAmount);
super._update(from, address(0), burnAmount);
super._update(from, to, amount - totalTax);

In the current implementation there is a emergencyWithdraw function which allows the entire RAAC balance to be sent to the treasury in cases of emergency. However, this method has a whenPaused modifier meaning that each distribution would require a pause beforehand. Furthermore the emergency method also sends the funds directly to the treasury which also has a specific method to deposit them which is unused (topic of another submission). In the end, the funds are still lost since they can't be pulled from the treasury either.

Impact

Loss of funds, broken core functionality

Mitigation

Use the designated method instead of direct transfers

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!