Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Access control in collectFee, FeeCollector.sol

hawks

Summary

The collectFee function is missing access control, allowing any external user to trigger fee collection instead of limiting it to FEE_MANAGER_ROLE. This could lead to unauthorized fee collection, impacting fund integrity.

Below we can see the NatSpec documentation for each role.

@dev Three distinct roles with specific permissions:
// * - FEE_MANAGER_ROLE: Controls fee parameters and distribution rules
* - EMERGENCY_ROLE: Can pause contract and execute emergency functions
* - DISTRIBUTOR_ROLE: Authorized to trigger fee distributions

Vulnerability Details

The collectFee function does not implement access control, which means anyone can call the function and transfer tokens to the contract. This violates the NatSpec role definitions, where only authorized roles (such as FEE_MANAGER_ROLE should be able to manage fees.

function collectFee(uint256 amount, uint8 feeType) external override nonReentrant whenNotPaused returns (bool) {
if (amount == 0 || amount > MAX_FEE_AMOUNT) revert InvalidFeeAmount();
if (feeType > 7) revert InvalidFeeType();
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_updateCollectedFees(amount, feeType);
emit FeeCollected(feeType, amount);
return true;
}

Impact

Missing Role Restriction:

  • The function is external, meaning anyone can call it.

  • It should be restricted to FEE_MANAGER_ROLE.

  • Unauthorized Fee Collection Risk:

    • Any user can call collectFee and force the contract to collect arbitrary amounts of tokens.

Tools Used

Manual review

Recommendations

Restrict access to FEE_MANAGER_ROLE to ensure only authorized users can collect fees.

function collectFee(uint256 amount, uint8 feeType) external override nonReentrant whenNotPaused onlyRole(FEE_MANAGER_ROLE) returns (bool) {
if (amount == 0 || amount > MAX_FEE_AMOUNT) revert InvalidFeeAmount();
if (feeType > 7) revert InvalidFeeType();
raacToken.safeTransferFrom(msg.sender, address(this), amount);
_updateCollectedFees(amount, feeType);
emit FeeCollected(feeType, amount);
return true;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.