Core Contracts

Summary

There is no implementation for the transfer of RAAC token ownership. It is not in accordance to what the documentation state. The documentation mentions that one of the purpose of the RAACMinter contract is:

• Implement a secure, time-delayed mechanism for transferring RAACToken ownership

  
  https://docs.raac.io/core/minters/RAACMinter

Vulnerability Details

There are some variables declared in the contract assumably for the implementation for the time-delayed and secure mechanism to transfer ownership of the RAAC token. TIMELOCK_DURATION and timeLocks but these variables are not being used rather is there is any function to transfer RAAC token. Even in the RAAC token contract, there is no such implementation.

The documentation also states:

• Implements a 7-day delay mechanism for transferring RAACToken ownership

• Provides a 24-hour window after the delay period to complete the ownership transfer

Impact

RAAC token ownership cannot be transfered securely.

Tools Used

Manual review.

Recommendations

Add implementation for transfer of RAAC token while utilizing those unused variables.