Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

RAACReleaseOrchestrator Lacks Balance Verification For Token Distribution

casinocompiler

Summary

The RAACReleaseOrchestrator.sol contract, responsible for distributing 65% of the total RAAC supply through vesting schedules, does not verify it has sufficient RAAC token balance before creating vesting schedules or during token releases. While the contract defines allocation limits for different categories (team, advisors, treasury, etc.), this amount is not preminted during initialisation, and so, it doesn't ensure it has the tokens to fulfill these obligations.

Vulnerability Details

In RAACReleaseOrchestrator.release():

function release() external nonReentrant whenNotPaused {
address beneficiary = msg.sender;
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 releasableAmount = _calculateReleasableAmount(schedule);
if (releasableAmount == 0) revert NothingToRelease();
// Lack of check for contractBalance >= releasableAmount
schedule.releasedAmount += releasableAmount;
schedule.lastClaimTime = block.timestamp;
raacToken.transfer(beneficiary, releasableAmount);
emit TokensReleased(beneficiary, releasableAmount);
}

The contract lacks:

  1. Initial balance verification during schedule creation

  2. Balance checks before releasing tokens

  3. A mechanism to ensure total vested amounts match available tokens

This is being highlighted as an issue as RAAC tokens are not being preminted during protocol initialization.

Impact

Low - No loss of funds, only potential reverts.

Recommendations

Add a balance verification in createVestingSchedule:

function createVestingSchedule(
address beneficiary,
bytes32 category,
uint256 amount,
uint256 startTime
) external onlyRole(ORCHESTRATOR_ROLE) whenNotPaused {
// ... existing checks ...
uint256 contractBalance = raacToken.balanceOf(address(this));
require(contractBalance >= amount, "Insufficient contract balance");
// ... rest of the function ...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.