Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing ability to revoke roles

kineticsofweb3

Summary

I identifiy a critical vulnerabilitiy in the Treasury contract, focusing on role management and access control issues. The primary finding concerns the inability to revoke administrative roles, which poses significant security risks to treasury funds.

Vulnerability Details

1. Missing Role Revocation (High Severity)

Description:

// Current implementation lacks role revocation
contract Treasury is ITreasury, AccessControl, ReentrancyGuard {
// No mechanism to revoke roles
// Cannot remove compromised accounts
// Permanent administrative access

Technical Analysis:

  • Inherits from OpenZeppelin's AccessControl but doesn't implement revocation

Proof of Concept:

// Example of permanent access vulnerability
function exploit() external {
// If manager's key is compromised, cannot remove access
require(hasRole(MANAGER_ROLE, compromisedAddress), "Not compromised");
withdraw(token, amount, attacker);
}

2. Allocation Tracking Issues

Description:

function allocateFunds(address recipient, uint256 amount) external override
onlyRole(ALLOCATOR_ROLE) {
// No validation against actual balances
_allocations[msg.sender][recipient] = amount;
}

Technical Analysis:

  • Discrepancy between recorded and actual allocations

Impact

  • Permanent unauthorized access to treasury funds

  • Inability to respond to security incidents

  • Regulatory compliance risks

Tools Used

  • Solidity static analysis

  • Access control pattern analysis

  • Security best practices review

Recommendations

Critical Fixes

  1. Implement Role Revocation

function revokeManagerRole(address account) external onlyRole(DEFAULT_ADMIN_ROLE) {
require(account != msg.sender, "Cannot revoke own role");
revokeRole(MANAGER_ROLE, account);
emit RoleRevoked(MANAGER_ROLE, account, msg.sender);
}

  1. Add Allocation Validation

function allocateFunds(address recipient, uint256 amount) external override
onlyRole(ALLOCATOR_ROLE) {
require(_balances[msg.sender] >= amount, "Insufficient balance");
_allocations[msg.sender][recipient] = amount;
}

Security Enhancements

  1. Add Event Emissions

event RoleRevoked(bytes32 indexed role, address indexed account, address indexed sender);
event AllocationUpdated(address indexed allocator, address indexed recipient, uint256 amount);

  1. Implement Access Control Validation

modifier onlyOneRole(bytes32 role1, bytes32 role2) {
require(!hasRole(role1, msg.sender) || !hasRole(role2, msg.sender),
"Cannot have both roles");
_;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!