Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

ERC20 Tokens Locked in RAACNFT Contract

anomX

Summary

The RAACNFT contract has an issue in its mint function where users pay with an ERC20 token, but there is no mechanism to withdraw these tokens from the contract. As a result, the tokens remain locked indefinitely.

Vulnerability Details

Source

In the mint function, users pay for an NFT using an ERC20 token:

​
*function* mint(*uint256* *_tokenId*, *uint256* *_amount*) *public* *override* {
​
*uint256* price = raac_hp.tokenToHousePrice(_tokenId);
​
if (price == 0) revert RAACNFT__HousePrice();
​
if (price > _amount) revert RAACNFT__InsufficientFundsMint();
​
// transfer ERC20 from user to contract - requires pre-approval from user
​
  token.safeTransferFrom(msg.sender, *address*(this), _amount);
​
​
​
// mint tokenId to user
​
_safeMint(msg.sender, _tokenId);
​
​
​
// If user approved more than necessary, refund the difference
​
if (_amount > price) {
​
*uint256* refundAmount = _amount - price;
​
  token.safeTransfer(msg.sender, refundAmount);
​
  }
​
​
​
emit NFTMinted(msg.sender, _tokenId, price);
​
}
​

The issue arises because the contract never provides a way to withdraw the received ERC20 tokens. This leads to a situation where the contract accumulates tokens that are inaccessible.

Impact

  • The contract becomes a sink for ERC20 tokens, making them permanently inaccessible.

  • The loss funds collected from NFT sales.

Tools Used

  • Manual code review

Recommendations

To prevent funds from being permanently locked, implement a withdraw mechnism that allows token withdrawal from the contract

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.