Core Contracts

Summary

An issue has been identified in the _initializeFeeTypes() function where incorrect basis points (bps) are used for the "Buy/Sell Swap Tax" and "NFT Royalty Fees" calculations. The intended percentages as per the comments do not align with the assigned values, leading to incorrect fee distributions.

Vulnerability Details

Issue: Incorrect Basis Points Assigned for Fee Calculations

Buy/Sell Swap Tax (2% total)

• Intended allocation:

  • veRAACShare: 0.5% (50 bps)

  • burnShare: 0.5% (50 bps)

  • repairShare: 1.0% (100 bps)

• Actual allocation in code:

  • veRAACShare: 500 (5.0%)

  • burnShare: 500 (5.0%)

  • repairShare: 1000 (10.0%)

• Issue: The total sum equals 20% instead of 2%.

NFT Royalty Fees (2% total)

• Intended allocation:

  • veRAACShare: 0.5% (50 bps)

  • burnShare: 0%

  • repairShare: 1.0% (100 bps)

  • treasuryShare: 0.5% (50 bps)

• Actual allocation in code:

  • veRAACShare: 500 (5.0%)

  • burnShare: 0%

  • repairShare: 1000 (10.0%)

  • treasuryShare: 500 (5.0%)

• Issue: The total sum equals 20% instead of 2%.

Impact

• Overcharging of Fees: The fees deducted from transactions are ten times higher than the intended values.

• Misalignment with Protocol Expectations: Users will be incorrectly charged higher swap taxes and royalty fees, leading to unfair financial loss.

Tools Used

• Manual Code Review

• Basic Arithmetic Verification

Recommendations

1. Correct the Basis Points Assignments:

   • Buy/Sell Swap Tax:

     feeTypes[6] = FeeType({

     veRAACShare: 50, // 0.5%

     burnShare: 50, // 0.5%

     repairShare: 100, // 1.0%

     treasuryShare: 0

     });

     ​

   • NFT Royalty Fees:

     feeTypes[7] = FeeType({

     veRAACShare: 50, // 0.5%

     burnShare: 0,

     repairShare: 100, // 1.0%

     treasuryShare: 50 // 0.5%

     });

     ​