Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Tokens Permanently Locked After Emergency Revoke

waydou

Summary

The RAACReleaseOrchestrator's emergencyRevoke function currently transfers tokens to itself, which is both redundant and inconsistent with the function's event emission. This should either be removed entirely or the tokens should be transferred to the beneficiary based on the intended behavior.

Vulnerability Details

function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 unreleasedAmount = schedule.totalAmount - schedule.releasedAmount;
delete vestingSchedules[beneficiary];
if (unreleasedAmount > 0) {
raacToken.transfer(address(this), unreleasedAmount); // @audit Transfers to itself
emit EmergencyWithdraw(beneficiary, unreleasedAmount); // Event suggests withdrawal to beneficiary
}
emit VestingScheduleRevoked(beneficiary);
}

The issue is:

  1. Emergency revoke removes the vesting schedule

  2. Tokens remain in the contract

  3. The contract has no function to release/withdraw these tokens

  4. release() function only works for active vesting schedules

  5. No admin/emergency function exists to recover these tokens

Impact

Tokens become permanently locked in the contract after emergency revoke.

Tools Used

Manual Review

Recommendations

Add functionality to handle revoked tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!