Fee Collector Distribution Fails Due to Token Transfer Fee Discrepancy
Summary
The FeeCollector contract fails to account for RAAC token transfer fees, causing the distributeCollectedFees() function to revert due to insufficient balance checks.
Vulnerability Details
The FeeCollector contract tracks collected fees fully but receives less due to RAAC token transfer fees. This mismatch causes the distribution
function to revert when checking contract balances against recorded fee amounts.
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/collectors/FeeCollector.sol#L403
if (contractBalance < totalFees) revert InsufficientBalance();
Impact
All fee distributions become impossible
Protocol rewards cannot be distributed to stakeholders
Fees become permanently locked in the contract
Tools Used
Manual code review
Recommendations
Track actual received amounts after fees
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.