Core Contracts

Summary

The FeeCollector contract's fee tracking mechanism is completely bypassed due to RAACToken directly transferring fees to the FeeCollector address without invoking the collectFee() function, resulting in a broken reward distribution system.

Vulnerability Details

The core issue lies in the misalignment between how fees are sent to the FeeCollector and how they are tracked:

In RAACToken.sol, fees are directly transferred to the feeCollector address in the _update() function:

However, the FeeCollector contract expects fees to be tracked via its collectFee() function which updates internal accounting:

Because collectFee() is never called, the internal fee tracking (CollectedFees struct) remains at zero:

This breaks the entire fee distribution mechanism since distributeCollectedFees() will always revert due to zero tracked fees, also making it impossible for users to claimRewards.

PoC

1. User makes a transfer incurring 1.5% tax (1% swap + 0.5% burn)

2. RAACToken sends tax directly to feeCollector address

3. FeeCollector's CollectedFees struct remains at 0 despite having tokens

4. distributeCollectedFees() reverts due to totalFees == 0

5. Users cannot claim rewards as distribution never occurs

Impact

The core fee distribution mechanism of the protocol is completely non-functional, preventing users from receiving their entitled rewards.

Tools Used

Manual code review

Recommendations

Fix is not trivial but you can Try Modify RAACToken's _update() to call FeeCollector's collectFee() instead of direct transfer or try something else.