Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Update Functionality for Key Addresses Such as Token and Oracle in RAACNFT Contract

0xblackadam

Description

The RAACNFT contract has vulnerabilities related to immutable dependencies, price oracle integration, and token. The contract permanently binds critical external contract addresses at deployment with no update mechanism, potentially requiring redeployment if issues arise with dependent contracts.

constructor(address _token, address _housePrices, address initialOwner)
ERC721("RAAC NFT", "RAACNFT")
Ownable(initialOwner)
{
if (_token == address(0) || _housePrices == address(0) || initialOwner == address(0))
revert RAACNFT__InvalidAddress();
token = IERC20(_token);
raac_hp = IRAACHousePrices(_housePrices);
}

Impact

  • Contract must be redeployed if token or oracle contracts need updating

  • Users could lose access to NFT functionality if dependent contracts fail

  • No emergency mechanisms for critical contract updates

  • Potential loss of funds if token contract becomes compromised

  • Service disruption if oracle needs upgrading

Fix Recommendations

  • Add update mechanisms for dependencies:

function setToken(address _newToken) external onlyOwner {
if (_newToken == address(0)) revert RAACNFT__InvalidAddress();
token = IERC20(_newToken);
emit TokenUpdated(_newToken);
}
​
function setHousePrices(address _newHousePrices) external onlyOwner {
if (_newHousePrices == address(0)) revert RAACNFT__InvalidAddress();
raac_hp = IRAACHousePrices(_newHousePrices);
emit HousePricesUpdated(_newHousePrices);
}

Tools Used

  • Manual code review

  • Foundry testing framework

  • Static analysis

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.