Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Tokens Received During NFT Minting Become Permanently Stuck

pelz

Summary

The mint function in RAACNFT.sol accepts ERC20 tokens as payment for NFTs but lacks a withdrawal mechanism. Since the contract is not upgradeable, the received funds become permanently locked, rendering them inaccessible.

Vulnerability Details

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
token.safeTransferFrom(msg.sender, address(this), _amount); // @audit-issue: Tokens are accepted but cannot be withdrawn
​
_safeMint(msg.sender, _tokenId);
​
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

Issue

  • The contract collects tokens but has no function to retrieve them.

  • Being non-upgradeable prevents any future addition of a withdrawal function.

  • Tokens remain locked indefinitely, causing potential fund loss.

Impact

  • Project owners lose access to user payments.

Tools Used

Manual code review.

Recommendations

Implement an owner-only withdrawal function:

function withdraw(address to, uint256 amount) external onlyOwner {
require(to != address(0), "Invalid address");
require(token.balanceOf(address(this)) >= amount, "Insufficient funds");
token.safeTransfer(to, amount);
}

Additionally, consider using a fee-collector contract to handle payments directly, reducing the risk of stuck funds.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!