Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Transfer Tax Mechanism in RAACToken Leading to DoS of StabilityPool.sol::depositRAACFromPool()

s0x0mtee

Summary

The RAACToken contract implements a transfer tax mechanism which when applied that can lead to unexpected behavior in the StabilityPool contract when transferring tokens. Specifically, if the transfer tax is enabled, the InvalidTransfer error in the depositRAACFromPool function of the StabilityPool contract will always revert due to the way the tax is applied during token transfers. This creates a situation where the expected balance after a transfer does not match the actual balance, leading to potential denial of service.

Vulnerability Details

The RAACToken contract has a transfer tax mechanism that is applied in the _update function. This function checks if the sender or receiver is whitelisted or if the fee collector is disabled. If none of these conditions are met, it applies a tax to the transfer amount. The relevant code snippet from the RAACToken contract is as follows:

function _update(
address from,
address to,
uint256 amount
) internal virtual override {
uint256 baseTax = swapTaxRate + burnTaxRate;
// Skip tax for whitelisted addresses or when fee collector disabled
if (
baseTax == 0 ||
from == address(0) ||
to == address(0) ||
whitelistAddress[from] ||
whitelistAddress[to] ||
feeCollector == address(0)
) {
super._update(from, to, amount);
return;
}
// All other cases where tax is applied
uint256 totalTax = amount.percentMul(baseTax);
uint256 burnAmount = (totalTax * burnTaxRate) / baseTax;
​
super._update(from, feeCollector, totalTax - burnAmount);
super._update(from, address(0), burnAmount);
super._update(from, to, amount - totalTax); // what is actually sent tio
}

In the StabilityPool contract, the depositRAACFromPool function checks if the balance after a transfer matches the expected balance:

if (postBalance != preBalance + amount) revert InvalidTransfer(); // -- Will always revert if baseTax != 0 (ie Fee on Transfer)

If the transfer tax is enabled, the postBalance will not equal preBalance + amount, causing the transaction to revert.

Impact

This vulnerability can lead to a denial of service for the depositRAACFromPool function in the StabilityPool contract. If the transfer tax is enabled, any attempt to deposit RAAC tokens from the liquidity pool will fail, preventing the contract from functioning as intended. This could impact the liquidity and overall usability of the system, as managers may be unable to deposit tokens when needed.

Tools Used

  • Manual code review

Recommendations

utilise manageWhitelist in RAACToken to implement logic that allows the RAACMinter address is whitelisted in the RAACToken contract to avoid the transfer tax being applied during deposits from the liquidity pool as currently there isn't one.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!