Submission Details
Severity:
No Mechanism for Role Revocation or Role Management on Treasury.sol
Summary
While roles are granted via AccessControl, there is no function to revoke roles or manage role assignments after the contract is deployed.
Vulnerability Details
_grantRole(DEFAULT_ADMIN_ROLE, admin);
_grantRole(MANAGER_ROLE, admin);
_grantRole(ALLOCATOR_ROLE, admin);
Impact
Once roles are granted, they cannot be changed or revoked. This can pose a security risk if an administrator's account is compromised or if roles need to be reallocated.
Tools Used
Recommendations
Implement a role management function that allows the contract owner or administrators to revoke and reassign roles when necessary.
function revokeRole(bytes32 role, address account) external onlyRole(DEFAULT_ADMIN_ROLE) {
_revokeRole(role, account);
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.