Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

updateFeeType not called distributeCollectedFees

ChainProof

Summary

The updateFeeType not called distributeCollectedFees which caused previously collected fees distribution based on newFee ratio causing incorrect fee distrution.

Vulnerability Details

The updateFeeType allows the FEE_MANAGER to update the parameters for a specific feeType.

function updateFeeType(uint8 feeType, FeeType calldata newFee) external override {
if (!hasRole(FEE_MANAGER_ROLE, msg.sender)) revert UnauthorizedCaller();
if (feeType > 7) revert InvalidFeeType();
// Validate fee shares total to 100%
if (newFee.veRAACShare + newFee.burnShare + newFee.repairShare + newFee.treasuryShare != BASIS_POINTS) {
revert InvalidDistributionParams();
}
feeTypes[feeType] = newFee;
emit FeeTypeUpdated(feeType, newFee);
}

An issue with the current implementation is that it is not called distributeCollectedFees for previously collected fees before updating, this will caused previous collected fees distribute based on newFee ratio which caused incorrect distribution to previous acumulated fees.

Impact

incorrect fee distrution.

Tools Used

Manual review

Recommendations

Invoke distributeCollectedFees function before changing the the updating the fee.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::updateFeeType applies new distribution parameters retroactively to already collected fees, allowing governance to change expected distribution outcomes before execution

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::updateFeeType applies new distribution parameters retroactively to already collected fees, allowing governance to change expected distribution outcomes before execution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.