Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

RAACToken burn() wil revert in case burnTaxRate set to 0

moray5554

Summary

RAACToken burn() wil revert in case burnTaxRate set to 0. This will be a problem if protocol decide to not charge fee on burning RAAC (it is intended, according to a code we have mechanic to handle such cases, meanwhile described issue won't make it possible)

Vulnerability Details

RAACToken.sol burn() looks like this

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
_burn(msg.sender, amount - taxAmount);
if (taxAmount > 0 && feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount);
}
}

As you can see the problem happens because percentMul called at burnTaxRate = 0. Why is this reverts?

function percentMul(uint256 value, uint256 percentage) internal pure returns (uint256 result) {
// to avoid overflow, value <= (type(uint256).max - HALF_PERCENTAGE_FACTOR) / percentage
assembly {
if iszero(
or(
iszero(percentage),
iszero(gt(value, div(sub(not(0), HALF_PERCENTAGE_FACTOR), percentage)))
)
) {
revert(0, 0)
}
​
result := div(add(mul(value, percentage), HALF_PERCENTAGE_FACTOR), PERCENTAGE_FACTOR)
}
}

As you can see percentMul() always revert when you pass 0 value as percentage input

Impact

Dos of burn() function and the one which relate to it's call when burnTax = 0

Tools Used

Manual review

Recommendations

add check if burnTaxRate =0 and do not process any tax-related activity when it's 0

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn() reverts when burnTaxRate is set to 0 due to division by zero in percentMul(), preventing intended fee-free burning functionality

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn() reverts when burnTaxRate is set to 0 due to division by zero in percentMul(), preventing intended fee-free burning functionality

Appeal created

inallhonesty Lead Judge
6 months ago
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!