Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Race Condition in RAACReleaseOrchestrator Token Distribution

foufrix

Summary

RAACReleaseOrchestrator creates vesting schedules without securing RAAC tokens upfront, causing a race condition where multiple investors compete for insufficient tokens.

Vulnerability Details

createVestingSchedule() do not transfer any amount of token to RAACReleaseOrchestrator.

There is no guarantee for investors that there will be enough funds for all vesting scheduled upfront.

Investors have to rely on RAAC team to supply enough funds to the contracts manually. This could be avoided if token were directly sent at creation of schedule

If there is not enough token, investors with a vesting schedule that end after other may end up with no token to claim.

Impact

No real guarantee that there will be enough tokens for all investors, resulting in late ones not having enough token to claim

Tools Used

Manual

Recommendations

Force token transfer on schedule creation.

function createVestingSchedule(
address beneficiary,
bytes32 category,
uint256 amount,
uint256 startTime
) external onlyRole(ORCHESTRATOR_ROLE) whenNotPaused {
if (beneficiary == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
if (vestingSchedules[beneficiary].initialized) revert VestingAlreadyInitialized();
if (categoryAllocations[category] == 0) revert InvalidCategory();
// Check category allocation limits
uint256 newCategoryTotal = categoryUsed[category] + amount;
if (newCategoryTotal > categoryAllocations[category]) revert CategoryAllocationExceeded();
categoryUsed[category] = newCategoryTotal;
VestingSchedule storage schedule = vestingSchedules[beneficiary];
schedule.totalAmount = amount;
schedule.startTime = startTime;
schedule.duration = VESTING_DURATION;
schedule.initialized = true;
raacToken.safeTransferFrom(msg.sender, address(this), amount);
emit VestingScheduleCreated(beneficiary, category, amount, startTime);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.