Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Fee distribution parameters can be modified between fee collection and distribution, leading to inconsistent and potentially incorrect fee allocation.

mo_

Summary

Fee distribution parameters can be modified between fee collection and distribution, leading to inconsistent and potentially incorrect fee allocation.

Vulnerability Details

The FeeCollector.sol contract allows updating feeTypes (distribution parameters) via updateFeeType. If feeTypes are changed after fees are collected using collectFee but before distributeCollectedFees is executed, the distribution in distributeCollectedFees will use the updated feeTypes, not the feeTypes active at the time of collection. This discrepancy can cause fees to be distributed based on unintended parameters.

** Code Snippets:**

// contracts/core/collectors/FeeCollector.sol
​
/**
* @notice Collects fees of a specific type
*/
function collectFee(uint256 amount, uint8 feeType) external override nonReentrant whenNotPaused returns (bool) {
// ...
// Update collected fees
_updateCollectedFees(amount, feeType);
// ...
}
​
/**
* @notice Updates parameters for a specific fee type
*/
function updateFeeType(uint8 feeType, FeeType calldata newFee) external override {
if (!hasRole(FEE_MANAGER_ROLE, msg.sender)) revert UnauthorizedCaller();
// ...
feeTypes[feeType] = newFee; // Fee types are directly updated
emit FeeTypeUpdated(feeType, newFee);
}
​
/**
* @notice Distributes collected fees according to protocol rules
*/
function distributeCollectedFees() external override nonReentrant whenNotPaused {
// ...
uint256[4] memory shares = _calculateDistribution(totalFees); // Distribution uses current feeTypes
_processDistributions(totalFees, shares);
// ...
}
​
/**
* @dev Calculates distribution shares for different stakeholders
*/
function _calculateDistribution(uint256 totalFees) internal view returns (uint256[4] memory shares) {
// ...
for (uint8 i = 0; i < 8; i++) {
// ...
FeeType memory feeType = feeTypes[i]; // Accesses current feeTypes
// ...
}
// ...
}

Impact

Incorrect fee distribution among veRAAC holders, burn address, repair fund, and treasury. This can lead to:

  • Loss of funds for intended recipients.

  • Unfair reward distribution to veRAAC holders.

  • Protocol governance issues due to misaligned incentives.

Tools Used

Manual code review.

Recommendations

Ensure fee distribution parameters used in distributeCollectedFees are consistent with those in place when fees were collected. Consider:

  1. Restrict Updates During Collection Period: Implement a mechanism to prevent feeType updates between the start of a fee collection period and the corresponding distribution.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::updateFeeType applies new distribution parameters retroactively to already collected fees, allowing governance to change expected distribution outcomes before execution

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::updateFeeType applies new distribution parameters retroactively to already collected fees, allowing governance to change expected distribution outcomes before execution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.