Core Contracts

Summary

The RAACMinter contract and the RAACToken contract handle the feeCollector address inconsistently, particularly to setting it to the zero address (address(0)). The RAACToken contract allows setting feeCollector to address(0) to disable fee collection, while the RAACMinter contract explicitly prevents this.

Vulnerability Details

In the RAACToken contract:

• The setFeeCollector function allows setting fee collector to address(0), which disables fee collection and emits a FeeCollectionDisabled event:

This is a deliberate design choice to provide a mechanism for disabling fees.
In the RAACMinter contract:

The setFeeCollector function includes a check that reverts if _feeCollector is the zero address:

This prevents the feeCollector from being set to address(0), which contradicts the functionality provided by RAACToken.

Impact

Inability to Disable Fees: Since RAACMinter does not allow setting feeCollector to address(0), users or administrators cannot disable fee collection through the RAACMinter interface. This limits the flexibility intended by the RAACToken design.

Potential for Misconfiguration: If an administrator attempts to disable fees by setting feeCollector to address(0) via RAACMinter, the transaction will revert, potentially leading to confusion or misconfiguration.

Root cause

The RAACMinter contract enforces a stricter policy by disallowing the zero address for feeCollector, while RAACToken allows it as a feature to disable fees.

Recommendations

Modify the setFeeCollector function in RAACMinter to allow setting feeCollector to address(0), consistent with RAACToken’s behavior. This ensures that fee collection can be disabled through the RAACMinter interface. For example: