Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: medium
Valid

`RAACMinter::setFeeCollector` should not revert on `zero address`

Summary

RAACMinter::setFeeCollector should not revert on zero address.

Because it is calling raacToken.setFeeCollector and on RAACToken::setFeeCollector we can see it says Fee collector can be set to zero address to disable fee collection

Vulnerability Details

RAACMinter::setFeeCollector

/**
* @dev Sets the fee collector address
* @param _feeCollector The address of the new fee collector
* @notice Only the contract owner can call this function
* @notice This function updates the fee collector address in the RAAC token contract
*/
function setFeeCollector(address _feeCollector) external onlyRole(UPDATER_ROLE) {
if (_feeCollector == address(0)) revert FeeCollectorCannotBeZeroAddress(); πŸ‘ˆπŸ‘ˆ
raacToken.setFeeCollector(_feeCollector); πŸ‘ˆπŸ‘ˆ
emit ParameterUpdated("feeCollector", uint256(uint160(_feeCollector)));
}

RAACToken::setFeeCollector -> accepts zero address to disable fee collection

/**
* @dev Sets the fee collector address
* @param _feeCollector The address of the new fee collector
*/
function setFeeCollector(address _feeCollector) external onlyOwner {
// Fee collector can be set to zero address to disable fee collection πŸ‘ˆπŸ‘ˆ
if(feeCollector == address(0) && _feeCollector != address(0)){
emit FeeCollectionEnabled(_feeCollector);
}
if (_feeCollector == address(0)){
emit FeeCollectionDisabled();
}
feeCollector = _feeCollector;
emit FeeCollectorSet(_feeCollector);
}

Impact

Disabling the fee is not possible through RAACMinter::setFeeCollector

Tools Used

Manual review

Recommendations

remove the zero address check on RAACMinter::setFeeCollector

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::setFeeCollector prevents disabling fees by blocking zero address assignment

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.