Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

RAACNFT contract forever locks collateral

aregen

Summary

A user must transfer ERC20 collateral equal in value to their real estate to the RAACNFT contract during minting. Since the RAACNFT contract has no method exposed to later transfer this ERC20 token to other addresses, this collateral has been forever locked in the contract. Any collateral sent during minting is therefore forever locked in the RAACNFT contract.

Vulnerability Details

The RAACNFT contract requires the user to transfer ERC20 collateral equal in value to their real estate to the RAACNFT contract during minting. It is obvious that burning the NFT should result in the collateral being unlocked and transferred back to the user (taking into account current house price and outstanding loans), however this is not the case. There is in fact no way to ever unlock the ERC20 tokens sent to the RAACNFT contract and they have therefore effectively been burned.

Here is the current mint function, showing the ERC20 token being transferred to the contract:

function mint(uint256 _tokenId, uint256 _amount) public override {
uint256 price = raac_hp.tokenToHousePrice(_tokenId);
if(price == 0) { revert RAACNFT__HousePrice(); }
if(price > _amount) { revert RAACNFT__InsufficientFundsMint(); }
​
// transfer erc20 from user to contract - requires pre-approval from user
token.safeTransferFrom(msg.sender, address(this), _amount);
​
// mint tokenId to user
_safeMint(msg.sender, _tokenId);
​
// If user approved more than necessary, refund the difference
if (_amount > price) {
uint256 refundAmount = _amount - price;
token.safeTransfer(msg.sender, refundAmount);
}
​
emit NFTMinted(msg.sender, _tokenId, price);
}

Impact

The impact of this vulnerability is severe:

  • All ERC20 tokens paid for minting NFTs become permanently locked

  • Neither users nor the contract owner can recover these funds

  • The total locked value increases with each mint operation

  • This necessarily leads to substantial financial losses proportional to the number of mints and total collateral value

Recommendations

The RAACNFT contract should offer the user the ability to burn their NFT and retrieve their collateral up to the current value of their real estate if there are no outstanding loans.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.