Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Treasury::allocateFunds lack validation for available funds

oxaudron

Summary

There is a function allocateFunds which is used to allocate funds . However there is no validation performed to check if the msg.sender has that amount of funds.

Attack scenario:

  • Allocator can allocate 100e18 tokens.

  • Allocator just has the balance of 1e18

  • Allocated victim can't do or use 'em.

Vulnerability Details

Here is the code, its clearly visible that the funds allocated to the recipient isn't checked if they exist or not

function allocateFunds(
address recipient,
uint256 amount
) external override onlyRole(ALLOCATOR_ROLE) {
if (recipient == address(0)) revert InvalidRecipient();
if (amount == 0) revert InvalidAmount();
//@audit what if there is not enough balance for the token present ?
_allocations[msg.sender][recipient] = amount;
emit FundsAllocated(recipient, amount);
}

Impact

  • Users can allocate more funds than what even exists

Tools Used

Manual review

Recommendations

Check balances before allocating, or lock the tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::allocateFunds doesn't say what token you are actually allocating, doesn't check balances, or existing allocations to other recipients

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.