Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

RAACReleaseOrchestrator Contract's emergencyRevoke Function Issue

01chenqing

Summary

The emergencyRevoke function in the RAACReleaseOrchestrator contract has a critical flaw that can lead to locked assets.

Vulnerability Details

After the tokens for a revoked beneficiary are transferred back to the contract, the categoryUsed for the corresponding category is not updated. This means that the total used allocation for that category (categoryUsed) does not reflect the revoked tokens.When attempting to create a new vesting schedule using the createVestingSchedule function after a revocation, the check if (newCategoryTotal > categoryAllocations[category]) will evaluate to true, as the revoked tokens have not been accounted for in categoryUsed. This leads to a revert and prevents further management of those tokens.

function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 unreleasedAmount = schedule.totalAmount - schedule.releasedAmount;
delete vestingSchedules[beneficiary];
if (unreleasedAmount > 0) {
raacToken.transfer(address(this), unreleasedAmount);
emit EmergencyWithdraw(beneficiary, unreleasedAmount);
}
emit VestingScheduleRevoked(beneficiary);
}
​
​
function createVestingSchedule(
address beneficiary,
bytes32 category,
uint256 amount,
uint256 startTime
) external onlyRole(ORCHESTRATOR_ROLE) whenNotPaused {
​
......
// Check category allocation limits
uint256 newCategoryTotal = categoryUsed[category] + amount;
if (newCategoryTotal > categoryAllocations[category])
revert CategoryAllocationExceeded();
categoryUsed[category] = newCategoryTotal;
......
}

Impact

it can result in assets being permanently locked due to improper state management when revoking vesting schedules.

Tools Used

Manual Code Review

Recommendations

Modify the emergencyRevoke function to correctly adjust the categoryUsed[category] value, reflecting the revoked tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke fails to decrement categoryUsed, causing artificial category over-allocation and rejection of valid vesting schedules

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACReleaseOrchestrator::emergencyRevoke fails to decrement categoryUsed, causing artificial category over-allocation and rejection of valid vesting schedules

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.