Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Improper fee setting requirement in `FeeCollector::updateFeeType()`

056Security

Summary

The RAAC protocol allows for dynamic fee-type settings in the FeeCollector contract. However, the current fee setting update function, incorrectly enforces the sum of all fee shares to be 100%, making it impossible to set low fee shares for specific types.

Vulnerability Details

If we look at how the fees are initially created, we can see that some fee types do not require a 100% share total:

function _initializeFeeTypes() internal {
__SNIP__
// Buy/Sell Swap Tax (2% total)
feeTypes[6] = FeeType({
veRAACShare: 500, // 0.5%
burnShare: 500, // 0.5%
repairShare: 1000, // 1.0%
treasuryShare: 0
});
// NFT Royalty Fees (2% total)
feeTypes[7] = FeeType({
veRAACShare: 500, // 0.5%
burnShare: 0,
repairShare: 1000, // 1.0%
treasuryShare: 500 // 0.5%
});
}

However, when these types need to be updated, the updateFeeType() enforces all shares to sum up to BASIS_POINTS, making it impossible to set lower fee shares:

function updateFeeType(uint8 feeType, FeeType calldata newFee) external override {
if (!hasRole(FEE_MANAGER_ROLE, msg.sender)) revert UnauthorizedCaller();
if (feeType > 7) revert InvalidFeeType();
// Validate fee shares total to 100%
@> if (newFee.veRAACShare + newFee.burnShare + newFee.repairShare + newFee.treasuryShare != BASIS_POINTS) { // @audit - fee shares can't be set to a lower sum of 100
revert InvalidDistributionParams();
}
feeTypes[feeType] = newFee;
emit FeeTypeUpdated(feeType, newFee);
}

Impact

Inability to create low-fee shares for specific fee types.

Tools Used

Manual review

Recommendations

Change the != comparison to >, so that the total sum can't go over 100%.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee shares for fee type 6 and 7 inside FeeCollector do not total up to the expected 10000 basis points, this leads to update problems, moreover they are 10x the specifications

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.