Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Tokens used as payment to Mint RAACNFTs in RAACNFT cannot be withdrawn

SafetyBytes

Summary

The RAACNFT contract accumulates token payments from users minting NFTs but provides no mechanism for owner/admin to access or withdraw these funds. All payments sent to this contract become permanently locked, effectively removing them from circulation while providing no benefit to the protocol or its users.

Vulnerability Details

When users mint NFTs in the RAACNFT contract, they must pay with ERC20 token:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
// @audit-issue -> token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

Looking at the whole RAACNFT contract there is no way for the owner/admin to withraw or use these accumulated ERC20 tokens. Effectively all of the tokens used for payments are locked in the contract.

Impact

  1. The tokens send from the user are permanently stuck in the contract with no way for the owner/admin to recover them.

  2. The tokens are not utilized anywhere else in the system.

Tools Used

Manual Review

Recommendations

Consider adding a withdrawal functionality:

function withdrawTokens(address to, uint256 _amount) external onlyOwner {
// Check if amount is valid
if(_amount == 0) revert RAACNFT__InvalidAmount();
​
// Check contract balance
uint256 contractBalance = token.balanceOf(address(this));
if(_amount > contractBalance) revert RAACNFT__InsufficientBalance();
​
// Transfer tokens to `to` address
token.safeTransfer(to, _amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.