Core Contracts

Summary

The RAACNFT contract prevents burning NFTs by disallowing transfers to address(0), while also lacking functionality to withdraw deposited tokens, resulting in permanent token lockup after minting.

Vulnerability Details

The RAACNFT::_update() function prevents transfers to address(0), which is the standard mechanism for burning NFTs in ERC721:

This means that users cannot burn their NFTs since the zero-address check prevents it, so once the NFT is minted, it cannot be destroyed.

However, the user paid with crvUSD tokens when minting the NFT, but he cannot get them back. Moreover, due to the absence of function for withdrawing the deposited tokens, even the contract owner cannot withdraw them, resulting in permanent token lockup.

Proof of Concept:

1. User mints an NFT by calling RAACNFT::mint with required tokens

2. The tokens are transferred to the contract and stored there

3. User attempts to burn the NFT but cannot due to address(0) check

4. The paid tokens remain locked in the contract permanently

5. Even the contract owner cannot withdraw the tokens due to missing functionality

Impact

• Users cannot burn NFTs they no longer want

• Tokens paid for minting are permanently locked in the contract

Recommendation

Consider adding a burn functionality, or a function for withdrawing the deposited tokens.