Submission Details
Severity:
Some admin functions in RAAC can not work
Summary
Some admin functions in RAAC can not work
Vulnerability Details
In RAAC token, there is some functions with one onlyOwner modifier. For example:
function setFeeCollector(address _feeCollector) external onlyOwner { }
function setSwapTaxRate(uint256 rate) external onlyOwner { _setTaxRate(rate, true); }
function setBurnTaxRate(uint256 rate) external onlyOwner { _setTaxRate(rate, false); }
function setTaxRateIncrementLimit(uint256 limit) external onlyOwner { }
function manageWhitelist(address account, bool add) external onlyOwner { }
In RAACMinter.sol, we can find out below functions:
function setSwapTaxRate(uint256 _swapTaxRate) external onlyRole(UPDATER_ROLE) {
if (_swapTaxRate > 1000) revert SwapTaxRateExceedsLimit();
raacToken.setSwapTaxRate(_swapTaxRate);
}
function setBurnTaxRate(uint256 _burnTaxRate) external onlyRole(UPDATER_ROLE) {
if (_burnTaxRate > 1000) revert BurnTaxRateExceedsLimit();
raacToken.setBurnTaxRate(_burnTaxRate);
}
function setFeeCollector(address _feeCollector) external onlyRole(UPDATER_ROLE) {
if (_feeCollector == address(0)) revert FeeCollectorCannotBeZeroAddress();
raacToken.setFeeCollector(_feeCollector);
}
So we can come to one conclusion that the RAACMinter will be the RAAC token's owner. The problem here is that we miss some interfaces in RAACMinter. This will cause that some admin functions in RAAC token, e.g. setTaxRateIncrementLimit cannot work as expected.
Impact
Some admin functions in RAAC can not work.
Tools Used
Manual
Recommendations
Add some interfaces in RAACMinter to support these admin functions in RAAC contract.
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RAACMinter lacks critical ownership transfer functionality and parameter management after receiving RAACToken ownership, causing permanent protocol rigidity
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RAACMinter lacks critical ownership transfer functionality and parameter management after receiving RAACToken ownership, causing permanent protocol rigidity
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.