Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Burn Amount When `feeCollector` is `address(0)` in `RAACToken` Contract

0xaadi

Summary

In RAACToken Contract, when feeCollector is set to address(0), the taxAmount is neither transferred nor burned. This results in the user spending fewer tokens than intended when calling burn(), leading to an unintended discrepancy in token supply behavior.

Vulnerability Details

In the burn() function, the tax amount is normally deducted from the total amount being burned and sent to the feeCollector. However, when feeCollector is address(0), the taxAmount is effectively ignored, meaning only (amount - taxAmount) is deducted from the user's balance, while taxAmount is neither transferred nor burned.

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
_burn(msg.sender, amount - taxAmount);
if (taxAmount > 0 && feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount);
}
}

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/RAACToken.sol#L80C1-L86C6

In the above code, if feeCollector == address(0), taxAmount is not deducted from the user, leading to a discrepancy where the expected amount of tokens is not burned.

Impact

This issue results in an inconsistency in the expected token burning process. When users attempt to burn tokens, they expect the full amount to be removed from caller, but when feeCollector is address(0), only (amount - taxAmount) is actually deducted, leading to an unintended deviation from expected supply mechanics.

Tools Used

Manual Review

Recommendations

To ensure correct token burning behavior, explicitly burn taxAmount when feeCollector is address(0)

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn incorrectly deducts tax amount but doesn't burn or transfer it when feeCollector is address(0), preventing complete token burns

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn incorrectly deducts tax amount but doesn't burn or transfer it when feeCollector is address(0), preventing complete token burns

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.