Core Contracts

Summary

The contract RAACTOKEN.SOL applies different validation rules for tax rate settings in the constructor compared to the update functions. While the constructor only checks if the initial tax rates exceed MAX_TAX_RATE, the _setTaxRate function enforces an additional constraint using taxRateIncrementLimit, which limits how much the tax rate can change in a single update.

Vulnerability Details
Constructor Behavior:

• The constructor only ensures that initialSwapTaxRate and initialBurnTaxRate do not exceed MAX_TAX_RATE.

• It does not apply any incremental limits, allowing the initial tax rates to be set arbitrarily within the maximum cap.

• Update Function Behavior:

  • _setTaxRate applies a stricter condition by checking whether the new tax rate exceeds the taxRateIncrementLimit.

If the new rate is more than currentRate + maxChange or is reduced by more than maxChange, the update is reverted with TaxRateChangeExceedsAllowedIncrement.

Inconsistency in Tax Rate Adjustments:

Since the constructor does not enforce taxRateIncrementLimit, the initial tax rate could be set significantly higher or lower than what an owner could later update it to.

This could create a scenario where an extremely high tax rate is set initially, but future owners cannot reduce it below the allowed increment limit in a single transaction.

Tools Used
Manual Review

Recommendations

Ensure Consistency:

• Apply taxRateIncrementLimit logic in the constructor to prevent drastic initial values.

• Alternatively, remove taxRateIncrementLimit in _setTaxRate if unrestricted initial values are intended.