Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of a mechanism to enforce allocation withdrawals

kineticsofweb3

Summary

The Treasury contract lacks a mechanism to enforce allocation withdrawals, creating a discrepancy between recorded allocations and actual token ownership. This vulnerability allows allocators to record allocations without having sufficient funds, potentially leading to double-spending.

Vulnerability Details

The allocateFunds function only records allocations in the _allocations mapping without validating or enforcing actual token transfers:

function allocateFunds(address recipient, uint256 amount) external override
onlyRole(ALLOCATOR_ROLE) {
if (recipient == address(0)) revert InvalidRecipient();
if (amount == 0) revert InvalidAmount();
_allocations[msg.sender][recipient] = amount;
emit FundsAllocated(recipient, amount);
}

Key issues:

  • No validation of allocator's available balance

  • No deduction of allocated amount from allocator's balance

  • No enforcement of allocation claims

Impact

  • Potential for double-spending of allocated funds

  • Inconsistent state between recorded allocations and actual token ownership

  • Potential for fund mismanagement

Tools Used

  • Manual code review

  • Static analysis

Recommendations

  1. Immediate Implementation

function allocateFunds(address recipient, uint256 amount) external override
onlyRole(ALLOCATOR_ROLE) {
require(_balances[msg.sender] >= amount, "Insufficient balance for allocation");
_allocations[msg.sender][recipient] = amount;
_balances[msg.sender] -= amount; // Deduct allocated amount
emit FundsAllocated(recipient, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::allocateFunds doesn't say what token you are actually allocating, doesn't check balances, or existing allocations to other recipients

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!