Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Direct Transfers Bypass Fee Distribution Logic

aksoy

Summary

The RAAC token contract sends tokens directly to the FeeCollector contract during transfers when taxes are applied. However, this bypasses the collectFee function, which is responsible for updating fee amounts and distributing tokens to valid users and the treasury. As a result, tokens sent directly to the FeeCollector are not properly accounted for or distributed, leading to inconsistencies in fee tracking and distribution.

Vulnerability Details

When taxes are applied during a transfer, the RAAC token contract sends tokens directly to the FeeCollector using super._update(from, feeCollector, totalTax - burnAmount). This bypasses the collectFee function, which is responsible for:

  • Updating the collected fee amounts (collectedFees).

  • Distributing tokens to valid users and the treasury.

function _update(
address from,
address to,
uint256 amount
) internal virtual override {
uint256 baseTax = swapTaxRate + burnTaxRate;
// Skip tax for whitelisted addresses or when fee collector disabled
if (baseTax == 0 || from == address(0) || to == address(0) || whitelistAddress[from] || whitelistAddress[to] || feeCollector == address(0)) {
super._update(from, to, amount);
return;
}
​
// All other cases where tax is applied
uint256 totalTax = amount.percentMul(baseTax);
uint256 burnAmount = totalTax * burnTaxRate / baseTax;
super._update(from, feeCollector, totalTax - burnAmount);
super._update(from, address(0), burnAmount);
super._update(from, to, amount - totalTax);
}

Impact

Tokens sent to the FeeCollector are not properly accounted for or distributed, leading to:

  • Inaccurate fee tracking.

  • Loss of funds, as tokens are stuck in the FeeCollector contract.

  • Inefficient distribution of rewards and fees.

Tools Used

Manual

Recommendations

Modify the _update function in the RAAC token contract to call the collectFee function when sending tokens to the FeeCollector. This ensures that the FeeCollector is aware of the incoming tokens and can properly update its state.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.