Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing updation in release() in the RAACReleaseOrchestrator.sol caues unfulfilled vesting

anonymousjoe

Summary

When a vestingSchedule is started the schedule.initialized = true is made. And whenever this is true a new vesting schedule cannot be started.

Vulnerability Details

it is expected that vesting is done not for the entire amount allocated at the start itself. This can be seen in the createVestingSchedule function

function createVestingSchedule(
address beneficiary,
bytes32 category,
uint256 amount,
uint256 startTime
) external onlyRole(ORCHESTRATOR_ROLE) whenNotPaused {
if (beneficiary == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
// check for vestingSChedule.initialized
if (vestingSchedules[beneficiary].initialized) revert VestingAlreadyInitialized();
if (categoryAllocations[category] == 0) revert InvalidCategory();
// Check category allocation limits
uint256 newCategoryTotal = categoryUsed[category] + amount;
// expecting multiple vesting schedules for the same category

But the issue is that, even after realeasing the entire funds in a vesting schedule, the vesting.initialized is not updated to false. Thus after 1 vesting schedule is made for a benificiary , another vesting schedule cant be made for the same benificiary. Thus only the initialal amount of RAAC token will be sent to the benificiary.

function release() external nonReentrant whenNotPaused {
address beneficiary = msg.sender;
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 releasableAmount = _calculateReleasableAmount(schedule);
if (releasableAmount == 0) revert NothingToRelease();
schedule.releasedAmount += releasableAmount;
schedule.lastClaimTime = block.timestamp;
raacToken.transfer(beneficiary, releasableAmount);
// @audit2 should ideally make the schedule.initialized = false if releasedAmount >= totalAmount
// else another vesting schedule cant be made (so if initially the complete vesting is not done
// owner will have to update the vesting category allocations)
emit TokensReleased(beneficiary, releasableAmount);
}



Impact

Unable to release entire RAAC tokens to the beneficiary

Tools Used

manual review

Recommendations

update the vestingSchedule.initialized when realeaseAmount >= totalAmount

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator restricts beneficiaries to a single vesting schedule across all categories, causing funds from secondary investments to be permanently lost

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!