Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Emergency revocation of vesting funds does not safeguard the assets

OpaBatyo

Summary

In case of an emergency revoaction of vested funds, the assets are not safeguarded out of the contract since they are transferred right back to it.

Vulnerability Details

The RAACReleaseOrchestrator contract is used for admins to allocate and vest assets. The contract contains an emergencyRevoke() function to revoke vesting schedules and vested assets in case of emergency:

function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 unreleasedAmount = schedule.totalAmount - schedule.releasedAmount;
delete vestingSchedules[beneficiary];
if (unreleasedAmount > 0) {
raacToken.transfer(address(this), unreleasedAmount);
emit EmergencyWithdraw(beneficiary, unreleasedAmount);
}
emit VestingScheduleRevoked(beneficiary);
}

The issue is that when they are revoked, the remaining vested amount is incorrectly transferred back into this contract instead of out of it to a safe place. I believe the intent of the developers was to transfer them out since:

  1. This function is supposed to be called in case of emergency

  2. They could have just deleted the vesting schedule without transferring the tokens back into the same contract as they would still be just remaining in its balance

Transferring them to the same address makes no sense.

Impact

Emergency revocation leaves assets remaining in unsafe place instead of transferring them out to a safe address/treasury.

Tools Used

Manual Review

Recommendations

Transfer out to protocol owned EOA or deposit into treasury in case of emergency revocations.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!