Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

RAACToken Contract's burn Function Issue

01chenqing

Summary

The burn function in the RAACToken contract incorrectly transfers tax amounts to the feeCollector contract using the _transfer function instead of the collectFee function. This prevents the correct distribution of fees, as the feeCollector contract is designed to only process fees collected through the collectFee function.

Vulnerability Details

The RAACToken contract's burn function has the issues:

The function utilizes _transfer to send the calculated tax amount to the feeCollector instead of using the collectFee function. This bypasses the necessary fee-collecting mechanism implemented in the feeCollector.

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
_burn(msg.sender, amount - taxAmount);
if (taxAmount > 0 && feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount); // Incorrectly using _transfer
}
}

Since the feeCollector is designed to distribute fees only when invoked through the collectFee function, using _transfer results in fees not being recorded properly. Consequently, these fees will not be correctly allocated or trigger any associated distribution logic.

function collectFee(uint256 amount, uint8 feeType) external override nonReentrant whenNotPaused returns (bool) {
if (amount == 0 || amount > MAX_FEE_AMOUNT) revert InvalidFeeAmount();
if (feeType > 7) revert InvalidFeeType();
// Transfer tokens from sender
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Update collected fees
_updateCollectedFees(amount, feeType);
emit FeeCollected(feeType, amount);
return true;
}

Impact

This vulnerability can lead to untracked fees, which can impact the operational efficiency and transparency of the fee distribution process. Failure to account for collected fees means that various financial calculations based on these fees might be incorrect, leading to potential losses and affecting user trust in the contract’s reliability.

Recommendations

Modify the burn Function: Ensure that the tax amount is sent to the feeCollector using the collectFee function instead of using _transfer

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!