Core Contracts

Summary

In the RAACToken contract, the burn function subtracts a tax amount from the tokens to be burned and then transfers this tax to the fee collector if one is set. However, when the fee collector is set to the zero address (i.e., fee collection is disabled), the tax amount is not deducted from the caller’s balance, resulting in an incomplete burn where the caller’s balance is only reduced by the net amount.

Vulnerability Details

The current implementation of the burn function is as follows:

In this implementation:

• If the feeCollector address is not zero, the function burns amount - taxAmount tokens from the caller’s balance and then transfers taxAmount tokens from the caller to the fee collector. This results in a total deduction of amount tokens.

• However, if feeCollector is set to the zero address, the conditional block does not execute, and only amount - taxAmount tokens are burned. Consequently, the caller’s balance is reduced by less than the intended amount.

This behavior is problematic because the burn function should always remove the full amount from the caller’s balance, regardless of whether the fee collector is set. When fee collection is disabled (i.e., feeCollector == address(0)), the tax portion should still be burned to maintain consistent token economics.

Impact

• Inconsistent Token Accounting:
  Users calling burn when the fee collector is unset will have their balance reduced by only amount - taxAmount, leaving them with a higher balance than expected.

Tools Used

• Manual code review

Recommended Mitigation

• Consistent Burn Behavior:
  Modify the burn function to ensure that the caller’s balance is always reduced by the full amount, regardless of whether the fee collector is set. For instance:

  function burn(uint256 amount) external {

  uint256 taxAmount = amount.percentMul(burnTaxRate);

  if (feeCollector == address(0)) {

  // When fee collection is disabled, burn the full amount.

  _burn(msg.sender, amount);

  } else {

  // When fee collection is enabled, burn the net amount and transfer the tax.

  _burn(msg.sender, amount - taxAmount);

  if (taxAmount > 0) {

  _transfer(msg.sender, feeCollector, taxAmount);

  }

  }

  }