Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

The FeeCollector contract does not account for the transfer fees associated with RAACToken, leading to a denial-of-service (DoS) condition when attempting to distribute rewards.

0x0noob

Details

The RAACToken contract imposes a fee on every transfer. However, the FeeCollector contract does not account for this fee, which results in a denial-of-service (DoS) condition when FeeCollector::distributeCollectedFees is called.

function _processDistributions(uint256 totalFees, uint256[4] memory shares) internal {
uint256 contractBalance = raacToken.balanceOf(address(this));
if (contractBalance < totalFees) revert InsufficientBalance();
...
}

The above is expected to cause the DOS, as the totalFees that will be recorded in the protocol is greater than the contract balance as a result of the associated fees from transfers.

Tool Used

Manual Review

POC

import {veRAACToken} from "../contracts/core/tokens/veRAACToken.sol";
import {FeeCollector} from "../contracts/core/collectors/FeeCollector.sol";
import {RAACToken} from "../contracts/core/tokens/RAACToken.sol";
import {Test, console} from "forge-std/Test.sol";
​
contract POC is Test {
RAACToken raacToken;
veRAACToken veRAAC;
FeeCollector feeCollector;
​
address owner = makeAddr("owner");
address user = makeAddr("user");
address treasury = makeAddr("treasury");
address repairFund = makeAddr("repairFund");
​
function setUp() public {
vm.startPrank(owner);
raacToken = new RAACToken( owner, 300, 300);
veRAAC = new veRAACToken(address(raacToken));
feeCollector = new FeeCollector(address(raacToken), address(veRAAC), treasury, repairFund, owner);
raacToken.setMinter(owner);
raacToken.mint(user, 10 ether);
vm.stopPrank();
}
​
function test_POC() public {
vm.startPrank(user);
raacToken.approve(address(feeCollector), 1 ether);
feeCollector.collectFee(1 ether, 1);
vm.stopPrank();
​
vm.startPrank(owner);
vm.expectRevert();
feeCollector.distributeCollectedFees();
vm.stopPrank();
}
}

Tested in foundry

Impact

DOS

Recommedation

Since RAACToken is a FOT, protocol should ensure that the amount been recorded as deposited in the protocol is same with what was actually received.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!