Core Contracts

Summary:

In the emergencyRevoke() function, when a beneficiary’s vesting is revoked, the contract attempts to transfer the unreleased tokens to itself using:

However, this is unnecessary since the contract already holds the tokens, and it incurs extra gas costs. Additionally, ithe RAAC token has a Fee-on-Transfer (FoT) mechanism, this self-transfer would result in an unintended deduction of tokens. And therefore with every successful call of emergencyRevoke() there is less tokens to release and can will cause ATLEAST one beneficiary (most probably the last cliamer) from being able to claim as a slightly less balance than his schedule.totalAmount would lead to reverts

Vulnerability details

Supporting Evidence: FoT in raacToken._update Function

Here is the relevant _update function in the RAAC token contract, confirming that a transfer tax is applied:

Impact:

• Gas Inefficiency: The contract pays gas for an unnecessary transfer.

• FoT Deduction Risk: If the RAAC token applies a transaction tax, the transferred amount will be reduced, permanently locking some tokens in the contract.

Recommendation:

Instead of transferring the tokens to the contract itself, simply delete the vesting schedule and adjust categoryUsed[category] accordingly.

Fixed Code Snippet:

Replace this:

With this:

This prevents unnecessary transfers while ensuring that the category allocation is correctly updated.