Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`RAACToken.setFeeCollector()` function doesn't allow zero address

pabloperezacc6

Summary

The RAACToken.setFeeCollector() function sets feeCollector of RAACToken and there is a check for param _feeCollector. This param should be not zero, however RAACToken allows zero address for feeCollector. Therefore, zero address can't be set as feeCollector in RAACToken.

Vulnerability Details

The check of RAACToken.setFeeCollector() function enforces the _feeCollector should not be zero.

function setFeeCollector(address _feeCollector) external onlyRole(UPDATER_ROLE) {
@> if (_feeCollector == address(0)) revert FeeCollectorCannotBeZeroAddress();
raacToken.setFeeCollector(_feeCollector);
emit ParameterUpdated("feeCollector", uint256(uint160(_feeCollector)));
}

However, feeCollector can be set to zero address to disable fee collection. As result, the feeCollector can be set zero address.

function setFeeCollector(address _feeCollector) external onlyOwner {
// Fee collector can be set to zero address to disable fee collection
if(feeCollector == address(0) && _feeCollector != address(0)){
emit FeeCollectionEnabled(_feeCollector);
}
if (_feeCollector == address(0)){
emit FeeCollectionDisabled();
}
feeCollector = _feeCollector;
emit FeeCollectorSet(_feeCollector);
}

Impact

The feeCollector in RAACToken can't be set zero.

Tools Used

Manual Review

Recommendations

Remove check for _feeCollector in RAACToken.setFeeCollector() function.

function setFeeCollector(address _feeCollector) external onlyRole(UPDATER_ROLE) {
- if (_feeCollector == address(0)) revert FeeCollectorCannotBeZeroAddress();
raacToken.setFeeCollector(_feeCollector);
emit ParameterUpdated("feeCollector", uint256(uint160(_feeCollector)));
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACMinter::setFeeCollector prevents disabling fees by blocking zero address assignment

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.