Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Tokens Stuck In RAACNFT

funkornaut

Summary

The RAACNFT contract accepts ERC20 tokens as payment for minting NFTs but has no mechanism to withdraw these tokens, resulting in them being permanently locked in the contract.

Vulnerability Details

The RAACNFT contract collects ERC20 tokens during the minting process but lacks any withdrawal functionality. This occurs in the mint() function:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

The contract:

  1. Accepts tokens via safeTransferFrom

  2. Keeps the price amount in the contract

  3. Has no function to withdraw these accumulated tokens

  4. Is not upgradeable

  5. Has no emergency withdrawal mechanism

This means that all tokens collected as payment for NFTs are permanently locked in the contract with no way to retrieve them.

Impact

  • HIGH SEVERITY

  • All tokens collected as payment for NFTs are permanently locked

  • The contract would need to be redeployed to fix this issue, requiring migration of all NFTs

Tools Used

  • Manual review

Recommendations

Add a withdrawal function that allows the owner to recover accumulated tokens:

function withdrawERC20(
address token,
address recipient,
uint256 amount
) external onlyOwner {
IERC20(token).safeTransfer(recipient, amount);
emit ERC20Withdrawn(token, recipient, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.