Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect initial fee amounts in FeeCollector

crunter

Summary

In the FeeCollector Fee types initializer, distribution percentages are set. Amounts are established according to the different protocol rules. However, fee percentages for buy and sell operations as well as NFT royalties are not consistent with the indicated in the documentation, resulting in incorrect protocol fee calculation and distribution.

Vulnerability Details

FeeCollector is the core contract for handling all protocol fee operations. It performs important tasks regarding the fee collection from different protocol activities and the time-weighted reward distribution to veRAAC holders.

Percentage fee amounts are established in the FeeCollector::_initializeFeeTypes, according to the different protocol rules and are expressed with two decimals of precision. However, fee percentages for buy and sell operations as well as NFT royalties are not consistent with the ones indicated in the documentation, resulting in incorrect fee calculation and distribution.

> FeeCollector.sol
​
function _initializeFeeTypes() internal {
// Protocol Fees: 80% to veRAAC holders, 20% to treasury
feeTypes[0] = FeeType({
veRAACShare: 8000, // 80%
burnShare: 0,
repairShare: 0,
treasuryShare: 2000 // 20%
});
// Lending Fees: Interest income distribution
feeTypes[1] = FeeType({
veRAACShare: 7000, // 70%
burnShare: 0,
repairShare: 0,
treasuryShare: 3000 // 30%
});
// Performance Fees: 20% from yield products
feeTypes[2] = FeeType({
veRAACShare: 6000, // 60%
burnShare: 0,
repairShare: 0,
treasuryShare: 4000 // 40%
});
// Insurance Fees: 3% from NFT loans
feeTypes[3] = FeeType({
veRAACShare: 5000, // 50%
burnShare: 0,
repairShare: 2000, // 20%
treasuryShare: 3000 // 30%
});
// Mint/Redeem Fees
feeTypes[4] = FeeType({
veRAACShare: 6000, // 60%
burnShare: 0,
repairShare: 2000, // 20%
treasuryShare: 2000 // 20%
});
// Vault Fees
feeTypes[5] = FeeType({
veRAACShare: 7000, // 70%
burnShare: 0,
repairShare: 0,
treasuryShare: 3000 // 30%
});
// Buy/Sell Swap Tax (2% total)
feeTypes[6] = FeeType({
// @audit - Regardless of what is indicated in the comments, percentages are equivalent to
// 5%, 5% and 10%, respectively, for a total of 20% instead 2%
@> veRAACShare: 500, // 0.5%
@> burnShare: 500, // 0.5%
@> repairShare: 1000, // 1.0%
treasuryShare: 0
});
// NFT Royalty Fees (2% total)
feeTypes[7] = FeeType({
// @audit - Regardless of what is indicated in the comments, percentages are equivalent to
// 5%, 10% and 5%, respectively, for a total of 20% instead 2%
@> veRAACShare: 500, // 0.5%
burnShare: 0,
@> repairShare: 1000, // 1.0%
@> treasuryShare: 500 // 0.5%
});
}

Impact

Impact: Medium

Likelihood: High

Tools Used

Manual Review

Recommendations

Use the correct percentage amounts taking into account the 2 decimal precision to maintain the system consistency.

> FeeCollector.sol
​
function _initializeFeeTypes() internal {
// Protocol Fees: 80% to veRAAC holders, 20% to treasury
feeTypes[0] = FeeType({
veRAACShare: 8000, // 80%
burnShare: 0,
repairShare: 0,
treasuryShare: 2000 // 20%
});
// Lending Fees: Interest income distribution
feeTypes[1] = FeeType({
veRAACShare: 7000, // 70%
burnShare: 0,
repairShare: 0,
treasuryShare: 3000 // 30%
});
// Performance Fees: 20% from yield products
feeTypes[2] = FeeType({
veRAACShare: 6000, // 60%
burnShare: 0,
repairShare: 0,
treasuryShare: 4000 // 40%
});
// Insurance Fees: 3% from NFT loans
feeTypes[3] = FeeType({
veRAACShare: 5000, // 50%
burnShare: 0,
repairShare: 2000, // 20%
treasuryShare: 3000 // 30%
});
// Mint/Redeem Fees
feeTypes[4] = FeeType({
veRAACShare: 6000, // 60%
burnShare: 0,
repairShare: 2000, // 20%
treasuryShare: 2000 // 20%
});
// Vault Fees
feeTypes[5] = FeeType({
veRAACShare: 7000, // 70%
burnShare: 0,
repairShare: 0,
treasuryShare: 3000 // 30%
});
// Buy/Sell Swap Tax (2% total)
feeTypes[6] = FeeType({
- veRAACShare: 500, // 0.5%
- burnShare: 500, // 0.5%
- repairShare: 1000, // 1.0%
+ veRAACShare: 50, // 0.5%
+ burnShare: 50, // 0.5%
+ repairShare: 100, // 1.0%
treasuryShare: 0
});
// NFT Royalty Fees (2% total)
feeTypes[7] = FeeType({
- veRAACShare: 500, // 0.5%
+ veRAACShare: 50, // 0.5%
burnShare: 0,
- repairShare: 1000, // 1.0%
- treasuryShare: 500 // 0.5%
+ repairShare: 100, // 1.0%
+ treasuryShare: 50 // 0.5%
});
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee shares for fee type 6 and 7 inside FeeCollector do not total up to the expected 10000 basis points, this leads to update problems, moreover they are 10x the specifications

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!