Core Contracts

Summary

The RAAC contracts does not check the return values of external calls, which can lead to unexpected behavior or security vulnerabilities. When a function call to an external contract fails, but the return value is not verified, the contract may assume the operation was successful, leading to potential loss of funds or incorrect state changes.

Vulnerability Details

The RAAC contracts in several instances do not check for return values, which can result in unexpected issues:

\

Impact

• Loss of funds due to silent failures in token transfers.

• Unexpected behavior in contract logic when external calls fail.

• Increased risk of exploits where attackers force failures and manipulate contract state.

Tools Used

• Manual review

Recommendations

• Always check return values of external calls, especially for token transfers

• Use OpenZeppelin’s SafeERC20 library, which wraps token transfers with proper checks