Core Contracts

Summary

The RAACReleaseOrchestrator contract establishes vesting schedules for various stakeholder categories and allocates tokens corresponding to 65% of the total supply. However, there is no mechanism within the contract to mint or supply the full token amount needed for these allocations, potentially leaving the vesting process without the necessary tokens.

Vulnerability Details

Within the RAACReleaseOrchestrator contract, category allocations are defined as follows:

• TEAM: 18,000,000 tokens (18%)

• ADVISOR: 10,300,000 tokens (10.3%)

• TREASURY: 5,000,000 tokens (5%)

• PRIVATE SALE: 10,000,000 tokens (10%)

• PUBLIC SALE: 15,000,000 tokens (15%)

• LIQUIDITY: 6,800,000 tokens (6.8%)

These allocations sum to 65,100,000 tokens, which the contract documentation claims represents 65% of the total supply. This implies an intended total supply significantly higher (for example, 100 million tokens if interpreted literally or possibly 1 billion tokens as hinted by the audit comment). Despite this, the RAACReleaseOrchestrator contains no logic to mint the full supply or to allocate the tokens needed for vesting. The contract assumes that tokens will be available for vesting without performing an initial minting operation.

Impact

• Token Distribution Failure: If the required tokens are not minted and allocated to the orchestrator contract, beneficiaries may not receive their vested tokens, causing a failure in the token distribution mechanism.

• Protocol Misconfiguration: The absence of an initial minting process can lead to misalignment between the intended tokenomics and the actual circulating supply, potentially undermining stakeholder confidence.

Tools Used

• Manual code review

Recommended Mitigation

Include a mechanism within the token distribution workflow—either in the RAACReleaseOrchestrator or as part of the deployment process—to mint the full intended token supply (or at least the amount corresponding to the 65% vesting allocation) and transfer it to the contract.