Core Contracts

Summary

When the FeeCollector is distributing via _processDistributions() the collected fees, it burns part of the them. However, it receives a portion back due to the burn tax mechanism in RAACToken, resulting in fewer tokens being burned than intended.

Vulnerability Details

The FeeCollector::_processDistributions() function attempts to burn a portion of collected fees by calling RAACToken::burn(). However, the RAACToken contract applies a burn tax on all burns, sending a portion back to the fee collector:

This creates a circular issue where:

1. FeeCollector tries to burn X tokens

2. RAACToken burns (X - burnTax) tokens

3. burnTax tokens are sent back to FeeCollector

4. These returned tokens remain in the FeeCollector and are used in the next distribution instead of being burned

Proof of Concept

1. FeeCollector collects 1000 RAAC tokens in fees

2. During distribution, it attempts to burn 100 RAAC (10% burn share)

3. With a 0.5% burn tax rate:

   • Actually burns: 99.5 RAAC

   • Returns to FeeCollector: 0.5 RAAC

4. Result: Only 99.5 tokens are burned instead of intended 100

Impact

• Protocol burns fewer tokens than intended by design

• Accumulation of "refunded" tokens in the FeeCollector that should have been burned

Recommendations

Implement a mechanism for bypassing the burn tax for the FeeCollector, either by creating a new function in RAACToken, or modifying the existing one.