Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of RAACToken Retrieval after emergencyRevoke.

akioniace

Summary

The RAACReleaseOrchestrator contract features an emergency revoke of vesting schedule, which is used for cancel the vesting and it will send the unreleased amount to RAACReleaseOrchestrator, but theres no way to get RAACToken from the contract and stuck forever in it.

Vulnerability Details

In RAACReleaseOrchestrator contract ORCHESTRATOR_ROLE create vesting schedule with RAACReleaseOrchestrator::createVestingSchedule() and provide the necessary param for creating schedule. for some reason when emergencyRevoke functions is executed by EMERGENCY_ROLE and unreleased amount is non-zero then unreleased amount send to the contract and theres no way to retrieve RAACToken from it SLOC#126-139.

// File: contracts/core/minters/RAACReleaseOrchestrator/RAACReleaseOrchestrator.sol
​
function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 unreleasedAmount = schedule.totalAmount - schedule.releasedAmount;
delete vestingSchedules[beneficiary];
if (unreleasedAmount > 0) {
raacToken.transfer(address(this), unreleasedAmount); // <@ root cause
emit EmergencyWithdraw(beneficiary, unreleasedAmount);
}
emit VestingScheduleRevoked(beneficiary);
}

RAACToken sent to this contract is forever stuck in it and cannot be retrieved by anyone.

Impact

Loss of Funds: Tokens that are stuck in the contract can't be accessed or used, potentially resulting in irreversible loss for beneficiaries or the contract owner.

Tools Used

  • Manual Review

Recommended Mitigation

Create function to recover RAACTokens transferred to this contract by the owner or any other trusted entity specified in the contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke sends revoked tokens to contract address with no withdrawal mechanism, permanently locking funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!