Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`RAACNFT` doesn't check for fee-on-transfer tokens

yeahchibyke

Summary

Buyers are meant to transfer tokens to mint RACCNFT pieces. But the contract does not protect against fee-on-transfer tokens.

Vulnerability Details

A token is to be specified by the deployer in the constructor of the RAACNFT contract. This token is to be used for buying RAACNFT pieces. But, I checked the README, NatSpec of the contract, and Discord, it is not specified what this token is. Which is safe to assume that such a token could be any ERC20. If the deployer specifies a fee-on-transfer token in the constructor, then the contract will always receive less than what was sent by the buyer.

Tools Used

  • Manual Review

Recommendations

Add checks to protect against fee-on-transfer tokens:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if (price == 0) revert RAACNFT__HousePrice();
if (price > _amount) revert RAACNFT__InsufficientFundsMint();
​
+ uint256 preBalance = token.balanceOf(address(this));
​
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
+ uint256 receivedAmount = token.balanceOf(address(this)) - preBalance; // calculate actual amount received by contract
​
+ if (receivedAmount < price) {
+ revert RAACNFT__InsufficientFundsMint();
+ } // ensure the received amount is at least the required price
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!