Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Validation on `feeCollector` for Taxed Burns

udo

Summary

The burn function does not properly handle scenarios where burnTaxRate is greater than zero, but feeCollector is set to the zero address. This could lead to an unintended situation where part of the burned amount is expected to be transferred as a tax, but there is no valid recipient, potentially resulting in incorrect balances.

Vulnerability Details

In the current implementation:

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
_burn(msg.sender, amount - taxAmount);
if (taxAmount > 0 && feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount);
}
}
​

If burnTaxRate > 0 but feeCollector == address(0), the function will still execute _burn(msg.sender, amount - taxAmount), but the tax portion will not be handled properly. The tax amount should either be included in the burn or a proper validation should be added before executing the function.

Impact

  • A portion of the user’s burned amount may be expected to be transferred as a tax, but since feeCollector is address(0), the function will revert as the to address is address(0).

  • This could lead to security vulnerabilities or incorrect supply calculations if not handled properly.

Recommendations

if feeCollector is address(0), burn the entire amount:

if (feeCollector == address(0)) {
_burn(msg.sender, amount);
} else {
uint256 taxAmount = amount.percentMul(burnTaxRate);
_burn(msg.sender, amount - taxAmount);
_transfer(msg.sender, feeCollector, taxAmount);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn incorrectly deducts tax amount but doesn't burn or transfer it when feeCollector is address(0), preventing complete token burns

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn incorrectly deducts tax amount but doesn't burn or transfer it when feeCollector is address(0), preventing complete token burns

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!