Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incomplete Token Burn When Fee Collector Is Not Set

calc1f4r

Summary

In the burn() function of the RAACToken contract, when feeCollector is set to address(0), the burning mechanism fails to burn the complete amount of tokens that the user intended to burn. The function calculates a tax amount but only burns amount - taxAmount. When there is no fee collector set, the taxAmount portion remains in the user's balance instead of being burned.

Users attempting to burn tokens when no fee collector is set will have taxAmount tokens remaining in their balance, contrary to their intention to burn the full amount. This creates confusion and requires additional transactions to burn the remaining tokens.

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/RAACToken.sol#L83C1-L86C6

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
_burn(msg.sender, amount - taxAmount);
if (taxAmount > 0 && feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount);
}
}

Impact

Additional gas costs if users need to make a second transaction to burn the remaining tokens

Recommendations

function burn(uint256 amount) external {
uint256 taxAmount = amount.percentMul(burnTaxRate);
_burn(msg.sender, amount - taxAmount);
if (taxAmount > 0) {
if (feeCollector != address(0)) {
_transfer(msg.sender, feeCollector, taxAmount);
} else {
_burn(msg.sender, taxAmount);
}
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn incorrectly deducts tax amount but doesn't burn or transfer it when feeCollector is address(0), preventing complete token burns

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACToken::burn incorrectly deducts tax amount but doesn't burn or transfer it when feeCollector is address(0), preventing complete token burns

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.