Core Contracts

Summary

The emergencyRevoke function in the RAACReleaseOrchestrator contract revokes a beneficiary’s vesting schedule and removes their vesting record. However, the function transfers the unreleased RAAC tokens to the contract’s own address instead of reassigning or redistributing them. Since the contract does not have a function to withdraw these tokens, they become permanently locked, making them inaccessible to any entity.

Vulnerability Details

RAACReleaseOrchestrator:: emergencyRevoke

• The function emergencyRevoke retrieves the unreleasedAmount (i.e., totalAmount - releasedAmount) of a beneficiary.

• The function deletes the vesting schedule for that beneficiary.

• It then transfers the unreleasedAmount to the contract’s own address (address(this)).

• The contract does not implement a mechanism to reclaim or redistribute these locked tokens.

• Since release() depends on vestingSchedules[beneficiary], and the vesting schedule has been deleted, the beneficiary loses access to their tokens.

This results in a permanent loss of the revoked tokens, as they remain inaccessible within the contract.

Impact

Unreleased RAAC tokens will be permanently locked in the contract. The total supply of circulating RAAC tokens will be reduced.

Tools Used

Manual

Recommendations

Instead of transferring the tokens to the contract, consider transferring them to a designated treasury or an administrator address. Or implement a function to recover and redistribute revoked tokens.