Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

In RAACReleaseOrchestrator category allocations are not immutable after initialization

avoloder

Summary

Category allocations in `RAACReleaseOrchestrator` are not immutable but they should be

Vulnerability Details

RaacReleaseOrchestrator manages the vesting and release of RAAC tokens for various stakeholders. It also implements vesting schedules for inital token distribution (65% of total supply). It defines following categories:

/// @notice Category identifiers
bytes32 public constant TEAM_CATEGORY = keccak256("TEAM");
bytes32 public constant ADVISOR_CATEGORY = keccak256("ADVISOR");
bytes32 public constant TREASURY_CATEGORY = keccak256("TREASURY");
bytes32 public constant PRIVATE_SALE_CATEGORY = keccak256("PRIVATE_SALE");
bytes32 public constant PUBLIC_SALE_CATEGORY = keccak256("PUBLIC_SALE");
bytes32 public constant LIQUIDITY_CATEGORY = keccak256("LIQUIDITY");

and in the constructor initializes allocations for each of these categories

// Initialize category allocations
categoryAllocations[TEAM_CATEGORY] = 18_000_000 ether; // 18%
categoryAllocations[ADVISOR_CATEGORY] = 10_300_000 ether; // 10.3%
categoryAllocations[TREASURY_CATEGORY] = 5_000_000 ether; // 5%
categoryAllocations[PRIVATE_SALE_CATEGORY] = 10_000_000 ether;// 10%
categoryAllocations[PUBLIC_SALE_CATEGORY] = 15_000_000 ether; // 15%
categoryAllocations[LIQUIDITY_CATEGORY] = 6_800_000 ether; // 6.8% (5.8% + 1%)

This clearly sets the allocations for each category and according to the official RAAC documentation, these allocations should be immutable after initialization. However, it is still possible to update them after the initialization, because there is a setter method

/**
* @notice Updates category allocation
* @param category Category to update
* @param newAllocation New allocation amount
* @dev Only callable by DEFAULT_ADMIN_ROLE
*/
//@audit-issue category allocations can be changed and are not immutable
function updateCategoryAllocation(
bytes32 category,
uint256 newAllocation
) external onlyRole(DEFAULT_ADMIN_ROLE) {
if (categoryAllocations[category] == 0) revert InvalidCategory();
if (newAllocation < categoryUsed[category]) revert InvalidAmount();
categoryAllocations[category] = newAllocation;
emit CategoryAllocationUpdated(category, newAllocation);
}

It is also not checked whether the total allocation percentage exceeds 100% when updating the category allocation.

Impact

Low

Tools Used

Manual Review

Recommendations

Do not allow updates of category allocations once initialized. If it is a design choice, and the documentation is outdated make sure to check if the sum of all allocations does not exceed 100%

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.