Submission Details
Severity:
The `collectFee` function is never called
Summary
The FeeCollector contract has an implemented fee collection and distribution system, but the collectFee function is never called by any other contract in the protocol, rendering the entire fee and reward system non-functional.
Vulnerability Details
While the FeeCollector implements a complete fee system:
function collectFee(uint256 amount, uint8 feeType) external override nonReentrant whenNotPaused returns (bool) {
if (amount == 0 || amount > MAX_FEE_AMOUNT) revert InvalidFeeAmount();
if (feeType > 7) revert InvalidFeeType();
// Transfer tokens from sender
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Update collected fees
_updateCollectedFees(amount, feeType);
emit FeeCollected(feeType, amount);
return true;
}
The contract defines various fee types intended for protocol operations:
// 0: Protocol Fees - General operations
// 1: Lending Fees - Lending/borrowing activities
// 2: Performance Fees - Yield products
// 3: Insurance Fees - NFT loan insurance
// 4: Mint/Redeem Fees - Token operations
// 5: Vault Fees - Vault management
// 6: Swap Tax - Trading operations
// 7: NFT Royalties - NFT transactions
However, no other contract in the protocol actually calls this function to collect fees.
Impact
High: Protocol's fee collection mechanism is non-functional.
Recommendations
Integrate fee collection in relevant protocol operations.
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
RAACToken::burn sends tax directly to FeeCollector without using collectFee(), causing tokens to bypass accounting and remain undistributed. `collectFee` is not used anywhere.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.