Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Tokens Stuck in Contract Due to RAACReleaseOrchestrator::emergencyRevoke() Implementation

josh4324

Summary

The emergencyRevoke() function is designed to revoke a vesting schedule for a beneficiary and reclaim the unvested tokens. However, the function transfers the unvested tokens to the contract itself, which has no withdrawal mechanism. This means that once the tokens are revoked, they become permanently locked within the contract, rendering them inaccessible.

Vulnerability Details

function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 unreleasedAmount = schedule.totalAmount - schedule.releasedAmount;
delete vestingSchedules[beneficiary];
if (unreleasedAmount > 0) {
raacToken.transfer(address(this), unreleasedAmount); // ❌ Tokens are sent to the contract itself
emit EmergencyWithdraw(beneficiary, unreleasedAmount);
}
emit VestingScheduleRevoked(beneficiary);
}
​

The function transfers the unvested tokens to address(this), but the contract has no function to withdraw or reclaim these tokens.

This permanently locks the tokens inside the contract, making them unusable.

The function deletes the vesting schedule but does not specify what should happen to the reclaimed tokens. If these tokens were meant to be redistributed or sent to a treasury, this is not handled.

If multiple revocations occur, a large amount of tokens can accumulate in the contract.

Impact

Tokens become permanently inaccessible

Tools Used

Manual Review

Recommendations

Introduce a withdrawTokens() function to recover any tokens accidentally sent to the contract.

Ensure that revoked tokens are transferred to a designated address (e.g., admin, treasury).

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.