Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`RAACReleaseOrchestrator` sends the user's token to itself locking the value inside the contract

77SecMentees

Summary

RAACReleaseOrchestrator::emergencyRevokeoffers a way for EMERGENCY_ROLE to allow users to get their tokens earlier than expected. The function query the beneficiary information, checks if exists, calculates the non-released amount and them delete the beneficiary information.

After deletion, check if the non-released amount is greater than zero. If it is, transfer it emitind a transfer event to communicate the transfer to the beneficiary address.

Vulnerability Details

The problem is that the receiver of the transfer is address(this) not the beneficiary. So, the sender and receiver are the same.

function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 unreleasedAmount = schedule.totalAmount - schedule.releasedAmount;
delete vestingSchedules[beneficiary];
if (unreleasedAmount > 0) {
- raacToken.transfer(address(this), unreleasedAmount); <@
emit EmergencyWithdraw(beneficiary, unreleasedAmount);
}
emit VestingScheduleRevoked(beneficiary);
}

Impact

As the beneficiary info is deleted, the tokens cannot be transferred through the normal process and will be locked in the contract.

Tools Used

Code Review

Recommendations

Update the transfer call to send the tokens to the beneficiary.

- raacToken.transfer(address(this), unreleasedAmount);
+ raacToken.transfer(beneficiary, unreleasedAmount);
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!