Core Contracts

Summary

The burnTaxRate is set to 0.5% in the RAACToken contract, which is intended to impose a fee on token burns. However, due to the way percentMul() handles decimal values, users can effectively bypass this fee by burning small amounts of tokens.

Vulnerability Details

When a user attempts to burn raccTokens, the tax is calculated as 0.5% of the amount being burned.

If the amount is small enough, the resulting tax may be less than 1 token. In Solidity, any fractional value is truncated to 0 when stored in a uint256 variable.

For example:

• if a user tries to burn 1 token, the tax would be calculated as:
  taxAmount = 0.005 which is effectively 0.

Impact

This vulnerability allows users to burn tokens without paying the associated tax, undermining the fee collection mechanism of the contract.

Tools Used

Manual Review

Recommendations

Introduce a minimum burn amount that must be met before the tax is applied. This ensures that any burn operation incurs a fee.