Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Unchangeable `Auction::businessAddress` after deployment can lead to loss of USDC received from buyers

kiteweb3

Summary

The Auction::businessAddress is the designated address that receives all USDC funds whenever someone purchases ZENO tokens by calling Auction::buy. This address is set once during deployment and is immutable.

This parameter is critical because it collects all USDC from purchases. After the auction closes, all collected USDC are transferred from this address back to ZENO for redemption. If the businessAddress is ever compromised or becomes inaccessible, all incoming auction funds would be lost, and subsequent redemptions would be impossible.

Additionally, although the documentation (see: https://github.com/Cyfrin/2025-02-raac/blob/main/docs/core/zeno/ZENO_BOND.md#ownership-and-access-control-2) references an updateBusinessAddress function for updating this address in case of compromise, no such function is actually implemented in the contract.

Vulnerability Details

The businessAddress address is set in the constructor and cannot be modified after contract deployment.

​
@> address public immutable businessAddress;
​
constructor(
address _zenoAddress,
address _usdcAddress,
@> address _businessAddress,
uint256 _startTime,
uint256 _endTime,
uint256 _startingPrice,
uint256 _reservePrice,
uint256 _totalAllocated,
address _initialOwner
) Ownable(_initialOwner) {
zeno = ZENO(_zenoAddress);
usdc = IUSDC(_usdcAddress);
@> businessAddress = _businessAddress;
state = AuctionState({
startTime: _startTime,
endTime: _endTime,
startingPrice: _startingPrice,
reservePrice: _reservePrice,
totalAllocated: _totalAllocated,
totalRemaining: _totalAllocated,
lastBidTime: 0,
lastBidder: address(0)
});
}
​

Impact

During calls to Auction::buy, all funds are sent directly to this address. If it becomes compromised during the auction, participants will unknowingly continue sending funds to the compromised address. Since there is no mechanism to redirect these funds, the entire auction's proceeds could be lost, making any future redemptions impossible.

Tools Used

Manual review.

Recommendations

Implement the missing Auction::updateBusinessAddress function.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.