Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`RAACReleaseOrchestrator::constructor` using `ether` amount for `categoryAllocations` which is wrong

sakibcy

Vulnerability Details

RAACReleaseOrchestrator::constructor using ether amounts for categoryAllocations which is wrong.

On the doc, we can see on Implementation Details

Category Allocations:
​
Team: 18% (18,000,000 RAAC)
Advisors: 10.3% (10,300,000 RAAC)
Treasury: 5% (5,000,000 RAAC)
Private Sale: 10% (10,000,000 RAAC)
Public Sale: 15% (15,000,000 RAAC)
Liquidity: 6.8% (6,800,000 RAAC)
​

So the categoryAllocations are RAAC tokens amount.

If you want to perform any action with categoryAllocations now it will not work as expected. As it is using an ether amount for representation.

RAACReleaseOrchestrator::constructor

/**
* @notice Initializes the RAACReleaseOrchestrator contract
* @param _raacToken Address of the RAAC token
*/
constructor(address _raacToken) {
if (_raacToken == address(0)) revert InvalidAddress();
raacToken = IRAACToken(_raacToken);
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(ORCHESTRATOR_ROLE, msg.sender);
_grantRole(EMERGENCY_ROLE, msg.sender);
// Initialize category allocations
categoryAllocations[TEAM_CATEGORY] = 18_000_000 ether; // 18% 👈
categoryAllocations[ADVISOR_CATEGORY] = 10_300_000 ether; // 10.3% 👈
categoryAllocations[TREASURY_CATEGORY] = 5_000_000 ether; // 5% 👈
categoryAllocations[PRIVATE_SALE_CATEGORY] = 10_000_000 ether;// 10% 👈
categoryAllocations[PUBLIC_SALE_CATEGORY] = 15_000_000 ether; // 15% 👈
categoryAllocations[LIQUIDITY_CATEGORY] = 6_800_000 ether; // 6.8% (5.8% + 1%) 👈
}

Impact

As in the vulnerability details section, I told you it will not work as expected when you want to perform any actions with categoryAllocations. Sometimes it may revert.

Tools Used

Manual

Recommendations

To represent RAACToken use 10 ** 18. I mean if it is 100 Raac then use 100e18. Something like that.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!