Submission Details
Severity:
no checks for amount in allocatefunds function in treasury
Summary
in treasury contract allocatefunds function should be check the msg.sender have amount to allocate tot he recipient.
Vulnerability Details
in that function
function allocateFunds(
address recipient,
uint256 amount
) external override onlyRole(ALLOCATOR_ROLE) {
if (recipient == address(0)) revert InvalidRecipient();
if (amount == 0) revert InvalidAmount();
// here it should check allocater or msg.sender carry that much amount
_allocations[msg.sender][recipient] = amount;
emit FundsAllocated(recipient, amount);
}
this function should check msg.sender should check the amount which is going to allocate.
Impact
without check the amount 'msg.sender' carry or not that is missing so even if msg.sender does not have that amount it gets allocated over their.
Recommendations
add check for amount of msg.sender which he going to allocate money.
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
Treasury::allocateFunds doesn't say what token you are actually allocating, doesn't check balances, or existing allocations to other recipients
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.