Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Token Transfer to Treasury Leading to Stuck Funds

aksoy

Summary

The Treasury contract receives RAAC tokens directly via safeTransfer in the FeeCollector _processDistributions function. This bypasses the deposit function, which is responsible for updating the treasury's internal balance tracking (_balances and _totalValue). As a result, funds sent to the treasury will not be reflected in its internal state, making them inaccessible for withdrawal by managers. This could lead to permanent loss of protocol funds.

Vulnerability Details

The FeeCollector uses safeTransfer to send RAAC tokens to the treasury:

if (shares[3] > 0) raacToken.safeTransfer(treasury, shares[3]);

This bypasses the deposit function, which updates the treasury's internal state variables (_balances and _totalValue). The treasury's internal state is not updated when tokens are sent directly via safeTransfer. When a manager attempts to withdraw these tokens, the transaction will revert due to an underflow

function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
_balances[token] -= amount;
_totalValue -= amount;
IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}

Impact

Fees sent to the treasury will be stuck and inaccessible.

Tools Used

Manual

Recommendations

Replace the direct safeTransfer call with a call to the deposit function to ensure the treasury's internal state is updated correctly.

ITreasury(treasury).deposit(address(raacToken), shares[3]);
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::_processDistributions and emergencyWithdraw directly transfer funds to Treasury where they get permanently stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.