Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`FeeCollector::emergencyWithdraw` Function Leading to Potential Loss of User Rewards

0x23r0

Summary

The emergencyWithdraw function is implemented in a way that transfers the entire token balance held by the contract to the treasury when the contract is paused. This design fails to differentiate between protocol funds (collected fees) and user-owned rewards, resulting in the risk of inadvertently transferring user assets along with protocol funds.

Vulnerability Details

The function retrieves the entire token balance of the contract using raacToken.balanceOf(address(this)) (or for other tokens) and transfers it to the treasury. This operation does not consider the separation between funds intended for protocol operations and funds allocated for user rewards.

function emergencyWithdraw(address token) external override whenPaused {
if (!hasRole(EMERGENCY_ROLE, msg.sender)) revert UnauthorizedCaller();
if (token == address(0)) revert InvalidAddress();
​
uint256 balance;
if (token == address(raacToken)) {
balance = raacToken.balanceOf(address(this));
raacToken.safeTransfer(treasury, balance);
} else {
balance = IERC20(token).balanceOf(address(this));
SafeERC20.safeTransfer(IERC20(token), treasury, balance);
}
​
emit EmergencyWithdrawal(token, balance);
}
​

The emergency withdrawal mechanism does not account for the amounts already allocated or earmarked for user rewards (as maintained in mappings such as collectedFees or userRewards). This oversight means that user funds, which should be claimable separately, might be permanently redirected to the treasury.

Impact

  • Loss of User Rewards:
    Users may lose access to their rewards if an emergency withdrawal is executed, as their assets will be mistakenly transferred to the treasury.

Tools Used

Manual Code Review

Recommendations

Implement a clear segregation between protocol funds and user rewards.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::emergencyWithdraw sends all tokens to treasury without resetting collectedFees, breaking rewards and future distributions

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::emergencyWithdraw sends all tokens to treasury without resetting collectedFees, breaking rewards and future distributions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.