Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Unused `RToken.rescueToken()` Function Due to Missing Implementation in Reserve Pool Contract

0xaadi

Summary

The rescueToken() function in the RToken contract is currently unused because there is no implemented function in the Reserve Pool contract that calls it. As a result, its intended functionality cannot be executed.

Vulnerability Detail

The rescueToken() function is designed to allow the Reserve Pool to rescue mistakenly sent tokens, excluding the main asset. However, a review of the Reserve Pool contract reveals that there is no function that invokes rescueToken(). This makes the function effectively useless, as it cannot be triggered in the deployed contract system.

function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyReservePool {
if (recipient == address(0)) revert InvalidAddress();
if (tokenAddress == _assetAddress) revert CannotRescueMainAsset();
IERC20(tokenAddress).safeTransfer(recipient, amount);
}

Since onlyReservePool restricts access to this function, and no function within the Reserve Pool contract invokes it, there is no way to execute this function in practice.

Impact

Due to the absence of an implementation in the Reserve Pool contract, the rescueToken() function cannot be executed as intended. As a result, tokens mistakenly sent to the contract cannot be recovered, potentially leading to permanent loss of funds.

Tool Used

Manual Review

Recommendation

  • Implement a function in the Reserve Pool contract that properly invokes rescueToken().

  • Or allow contract owner to rescue tokens.

- function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyReservePool {
+ function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyOwner {
if (recipient == address(0)) revert InvalidAddress();
if (tokenAddress == _assetAddress) revert CannotRescueMainAsset();
IERC20(tokenAddress).safeTransfer(recipient, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::rescueToken() can never be called

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.