Core Contracts

Summary

The emergencyRevoke function unnecessarily transfers tokens to itself, triggering unnecessary tax fees due to the RAAC token's tax mechanism which reduces the funds available for future distribution.

Vulnerability Details

The RAACReleaseOrchestrator contract has an option to revoke the release of RAAC tokens to a beneficiary but keep in mind that the RAACReleaseOrchestrator contract actually holds RAAC tokens which are being released to the beneficiaries so the issue is that;

When emergency revoke is called, the function transfers unreleased tokens to address(this):

Since RAACToken implements tax on transfers (both swap and burn taxes), this self-transfer will unnecessarily incur taxes, reducing the actual amount of tokens retained by the contract.

PoC

1. Alice has a vesting schedule with 1000 RAAC tokens (unreleased)

2. Emergency role calls emergencyRevoke on Alice's address

3. Contract attempts to transfer 1000 tokens to itself

4. Due to RAAC's tax mechanism (1.5% total tax):

   • 15 tokens are taken as tax

   • Contract ends up with 985 tokens instead of 1000

Impact

Loss of tokens through unnecessary tax application when performing emergency revoke, reducing the total amount available for future distribution.

Tools Used

Manual review

Recommendations

Remove the unnecessary self-transfer since the tokens are already in the contract: