Core Contracts

Summary

The emergencyRevoke() function in RAACReleaseOrchestrator incorrectly transfers unreleased tokens to the contract itself instead of the beneficiary, resulting in permanent token loss.

Vulnerability Details

In the emergencyRevoke function, when revoking a vesting schedule, any unreleased tokens are meant to be returned to the beneficiary. However, the function incorrectly uses address(this) as the transfer recipient instead of the beneficiary address:

Proof of Concept

1. A vesting schedule is created for Alice with 1000 RAAC tokens

2. After 100 days, Alice has claimed 200 tokens, leaving 800 unreleased

3. Emergency role calls emergencyRevoke for Alice's address

4. Instead of sending the 800 tokens to Alice, they are transferred to the contract itself

5. The tokens become permanently locked in the contract as there is no function to withdraw them

Impact

• Beneficiaries lose their unreleased tokens when their vesting schedule is revoked

• Tokens become permanently locked in the contract

• The emergency revoke feature fails its intended purpose of returning tokens to beneficiaries

Recommendations

Option 1: Fix transfer recipient

Option 2: Remove emergency revoke

Consider removing the emergency revoke functionality entirely if it's not strictly necessary, as it introduces additional risk and complexity. The vesting schedule could be made immutable after creation.