Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

The FeeCollector contract does not account for the transfer fees associated with RAACToken, leading to a denial-of-service (DoS) condition when attempting to distribute rewards.

0x0noob

Details

The RAACToken contract imposes a fee on every transfer. However, the FeeCollector contract does not account for this fee, which results in a denial-of-service (DoS) condition when FeeCollector::distributeCollectedFees is called.

function _processDistributions(uint256 totalFees, uint256[4] memory shares) internal {
uint256 contractBalance = raacToken.balanceOf(address(this));
if (contractBalance < totalFees) revert InsufficientBalance();
...
}

The above is expected to cause the DOS, as the totalFees that will be recorded in the protocol is greater than the contract balance as a result of the associated fees from transfers.

Tool Used

Manual Review

POC

import {veRAACToken} from "../contracts/core/tokens/veRAACToken.sol";
import {FeeCollector} from "../contracts/core/collectors/FeeCollector.sol";
import {RAACToken} from "../contracts/core/tokens/RAACToken.sol";
import {Test, console} from "forge-std/Test.sol";
​
contract POC is Test {
RAACToken raacToken;
veRAACToken veRAAC;
FeeCollector feeCollector;
​
address owner = makeAddr("owner");
address user = makeAddr("user");
address treasury = makeAddr("treasury");
address repairFund = makeAddr("repairFund");
​
function setUp() public {
vm.startPrank(owner);
raacToken = new RAACToken( owner, 300, 300);
veRAAC = new veRAACToken(address(raacToken));
feeCollector = new FeeCollector(address(raacToken), address(veRAAC), treasury, repairFund, owner);
raacToken.setMinter(owner);
raacToken.mint(user, 10 ether);
vm.stopPrank();
}
​
function test_POC() public {
vm.startPrank(user);
raacToken.approve(address(feeCollector), 1 ether);
feeCollector.collectFee(1 ether, 1);
vm.stopPrank();
​
vm.startPrank(owner);
vm.expectRevert();
feeCollector.distributeCollectedFees();
vm.stopPrank();
}
}

Tested in foundry

Impact

DOS

Recommedation

Since RAACToken is a FOT, protocol should ensure that the amount been recorded as deposited in the protocol is same with what was actually received.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.