Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Beneficiaries Can Front-run `emergencyRevoke()` to Claim Unvested Tokens Through `release()`

0xshoonya

Summary

Vulnerability Details

The emergencyRevoke() function in RAACReleaseOrchestrator has a critical vulnerability where beneficiaries can front-run the revocation to claim tokens:

// Emergency revoke function
function emergencyRevoke(address beneficiary) external onlyRole(EMERGENCY_ROLE) {
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 unreleasedAmount = schedule.totalAmount - schedule.releasedAmount;
delete vestingSchedules[beneficiary];
if (unreleasedAmount > 0) {
raacToken.transfer(address(this), unreleasedAmount);
emit EmergencyWithdraw(beneficiary, unreleasedAmount);
}
emit VestingScheduleRevoked(beneficiary);
}
​
function release() external nonReentrant whenNotPaused {
address beneficiary = msg.sender;
VestingSchedule storage schedule = vestingSchedules[beneficiary];
if (!schedule.initialized) revert NoVestingSchedule();
uint256 releasableAmount = _calculateReleasableAmount(schedule);
if (releasableAmount == 0) revert NothingToRelease();
schedule.releasedAmount += releasableAmount;
schedule.lastClaimTime = block.timestamp;
raacToken.transfer(beneficiary, releasableAmount);
emit TokensReleased(beneficiary, releasableAmount);
}

The vulnerability exists because:

  1. The emergencyRevoke() function doesn't pause the contract or lock the beneficiary's ability to call release()

  2. There's a window between:

  • When the revoke transaction is seen in the mempool

  • When it's actually executed on-chain

A beneficiary can exploit this in the following way:

T1: EMERGENCY_ROLE submits emergencyRevoke(beneficiary) transaction
T2: Beneficiary sees this in mempool
T3: Beneficiary front-runs with release() at higher gas price
T4: release() executes first, claiming tokens
T5: emergencyRevoke() executes, but some tokens already claimed

Impact

Emergency revocation mechanism being partially or fully circumvented

Tools Used

Manual Review

Recommendations

Consider implementing a two-step revocation

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.