Core Contracts

Summary

github link

Vulnerability Details

When emergencyWithdraw calls raacToken.safeTransfer(treasury, balance), the RAAC token will apply its transfer tax (swapTaxRate + burnTaxRate), and since FeeCollector is set as the feeCollector in RAACToken, a portion of those fees will be sent back to the FeeCollector contract.

This means:

1. FeeCollector tries to emergency withdraw 100 tokens

2. Due to tax, ~98.5 tokens go to Treasury (assuming 1.5% total tax)

3. The 1.5 tokens tax gets sent back to FeeCollector

4. These tokens remain in FeeCollector despite the emergency withdrawal

Impact

This creates a situation where the emergency withdrawal can never fully clear the FeeCollector contract of RAAC tokens, as each withdrawal generates new fees that stay in the contract.

Tools Used

Recommendations

Whitelist the FeeCollector for tax-free transfers