Core Contracts

Summary

In the _initializeFeeTypes function, the last two fee types (Buy/Sell Swap Tax and NFT Royalty Fees) do not sum up to 10000 (100%), which results in incorrect fee calculations. This misconfiguration skews the distribution of fees, leading to more funds going to the treasury during _calculateDistribution.

Vulnerability Details

Example Scenario

1. The Buy/Sell Swap Tax fee type sums to 2000 instead of 10000:

   • veRAACShare = 500

   • burnShare = 500

   • repairShare = 1000

   • treasuryShare = 0

   • Total = 2000 (should be 10000)

2. The NFT Royalty Fees type sums to 2000 instead of 10000:

   • veRAACShare = 500

   • burnShare = 0

   • repairShare = 1000

   • treasuryShare = 500

   • Total = 2000 (should be 10000)

3. When _calculateDistribution runs:

   • The incorrectly defined fees cause lower weighted distributions for these types.

   • The leftover amounts are allocated to the treasury by default.

   • This reduces the expected shares for veRAAC holders, burn, and repair funds.

Impact

• Incorrect Fee Distribution – Some fee types do not allocate funds as expected.

• Excess Funds to Treasury – The miscalculation results in more fees being sent to the treasury instead of their intended destinations (veRAAC holders, burn, and repair).

• Potential Accounting Errors – The InvalidFeeAmount() revert condition could be triggered unexpectedly if total fees collected do not match expected distributions.

Tools Used

Manual review

Recommendations

Ensure All Fee Types Sum to 10000

Modify feeTypes[6] and feeTypes[7] so that their total always equals 10000 (100%).