Core Contracts

Summary

The RAACMinter contract is designed to manage the minting and distribution of RAAC tokens. However, it lacks a mechanism to set the minter address in the RAACToken contract, which results in the inability to mint new tokens. This oversight poses a significant risk to the token's functionality and overall ecosystem.

Vulnerability Details

In the RAACToken contract, the mint function is protected by the onlyMinter modifier, which restricts minting to a designated minter address. The minter address is set through the setMinter function, which is only callable by the contract owner. However, the RAACMinter contract, which is the RAACToken owner as it is responsible for most onlyOwner functions, does not provide a mechanism to set the minter address. As a result, if the minter is not set, the minting functionality becomes effectively disabled.

Impact

• The inability to set a minter address means that the RAAC token cannot be minted, which can lead to several issues:
  Token Supply Limitation: Without the ability to mint new tokens, the supply of RAAC tokens is fixed, potentially leading to scarcity and hindering the token's utility.

• Inability to Reward Users: The minting process is crucial for rewarding users and incentivizing participation in the ecosystem. Without minting, the rewards mechanism becomes ineffective.

Relevant snippets

• RAACToken.sol

Tools Used

• Manual review

Recommendations

Implement a Mechanism to Set the Minter: Introduce a function in the RAACMinter contract that allows the owner to set the minter address in the RAACToken contract. This will ensure that the minting functionality can be utilized effectively.