Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

FeeCollector Contract's _processDistributions Function Issue

01chenqing

Summary

The _processDistributions function in the FeeCollector contract directly transfers fees to the Treasury contract using safeTransfer. This results in funds being permanently locked.

Vulnerability Details

The _processDistributions function in the FeeCollector contract does not utilize the deposit function of the Treasury contract when distributing fees. Instead, it directly transfers assets using safeTransfer. This oversight results in funds being permanently locked within the Treasury contract, as the withdraw function can only extract assets that have been deposited via the deposit function. Consequently, any fees sent directly to the Treasury will become inaccessible and unable to be withdrawn.

In this _processDistributions function, if the token has not been deposited into the Treasury contract via the deposit function, its corresponding balance in the _balances mapping will be zero. When attempting to call the withdraw function for this token, a revert will occur because the withdraw function checks the _balances mapping and finds that there are insufficient funds (i.e., zero balance) for the token requested.

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
​
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
​
emit Deposited(token, amount);
}
​
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
​
_balances[token] -= amount;
_totalValue -= amount;
IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}
​
function _processDistributions(uint256 totalFees, uint256[4] memory shares) internal {
......
if (shares[3] > 0) raacToken.safeTransfer(treasury, shares[3]);
......
}

Impact

leads to funds becoming permanently inaccessible within the Treasury contract. This could result in financial losses for users

Tools Used

Manual Code Review

Recommendations

Modify the _processDistributions Function: Ensure that all transfers to the Treasury contract utilize the deposit function for proper handling of funds.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::_processDistributions and emergencyWithdraw directly transfer funds to Treasury where they get permanently stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!