Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Category Allocation Handling Upon Vesting Revocation

saikumar279

Summary

The RAACReleaseOrchestrator contract manages the vesting and release of RAAC tokens for various stakeholders. The RAACReleaseOrchestrator::emergencyRevoke function allows the revocation of a vesting schedule before completion. However, it does not properly adjust the RAACReleaseOrchestrator::categoryUsed allocation parameter when a vesting is revoked, leading to an inflated category allocation and potential inconsistencies in token distribution.

Vulnerability Details

1.Vesting Creation:

  • When a vesting schedule is created via RAACReleaseOrchestrator::createVestingSchedule, the categoryUsed[category] variable is incremented by the vesting amount.

  • This ensures that the total allocated tokens for a category do not exceed its predefined categoryAllocations.

RAACReleaseOrchestrator::createVestingSchedule:

function createVestingSchedule(
address beneficiary,
bytes32 category,
uint256 amount,
uint256 startTime
) external onlyRole(ORCHESTRATOR_ROLE) whenNotPaused {
if (beneficiary == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
if (vestingSchedules[beneficiary].initialized) revert VestingAlreadyInitialized();
if (categoryAllocations[category] == 0) revert InvalidCategory();
// Check category allocation limits
@> uint256 newCategoryTotal = categoryUsed[category] + amount;
@> if (newCategoryTotal > categoryAllocations[category]) revert CategoryAllocationExceeded();
@> categoryUsed[category] = newCategoryTotal;
VestingSchedule storage schedule = vestingSchedules[beneficiary];
schedule.totalAmount = amount;
schedule.startTime = startTime;
schedule.duration = VESTING_DURATION;
schedule.initialized = true;
emit VestingScheduleCreated(beneficiary, category, amount, startTime);
}

2.Vesting Revocation:

  • The RAACReleaseOrchestrator::emergencyRevoke function allows the revocation of a vesting schedule.

  • When revoked, any unreleased tokens remain in the contract but are not deducted from categoryUsed.

RAACReleaseOrchestrator::emergencyRevoke:

function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 unreleasedAmount = schedule.totalAmount - schedule.releasedAmount;
delete vestingSchedules[beneficiary];
if (unreleasedAmount > 0) {
raacToken.transfer(address(this), unreleasedAmount);
emit EmergencyWithdraw(beneficiary, unreleasedAmount);
}
emit VestingScheduleRevoked(beneficiary);
}

3.Impact of Incorrect Accounting:

  • Since categoryUsed remains unchanged despite vesting revocation, it results in an inflated recorded allocation for the category.

  • Future vesting schedules may be blocked under the assumption that the category has already reached its limit, even though some tokens are still in the contract.

Impact

  1. Incorrect Token Accounting: The categoryUsed value does not decrease upon revocation, causing a mismatch between actual and recorded allocations.

  2. Denial of Service (DoS) on Vesting Creation: If multiple vestings are revoked mid-way, categoryUsed may falsely indicate full utilization, preventing new vesting schedules from being created.

  3. Inefficient Token Utilization: Unreleased tokens remain stuck in the contract instead of being correctly reallocated or withdrawn.

Tools Used

Manual

Recommendations

  1. Modify the RAACReleaseOrchestrator::emergencyRevoke function to deduct the unreleased amount from categoryUsed[category] when revoking a vesting schedule.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke fails to decrement categoryUsed, causing artificial category over-allocation and rejection of valid vesting schedules

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke fails to decrement categoryUsed, causing artificial category over-allocation and rejection of valid vesting schedules

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!