Allocated Funds Are Not Sent and Cannot Be Withdrawn by Recipients Due to Role Restrictions
Summary
The allocateFunds function in the Treasury contract allows for the allocation of funds to specific recipients, but the allocated funds are never transferred. Additionally, only users with the MANAGER_ROLE can withdraw funds from Treasury.sol, preventing recipients from accessing their allocations.
Vulnerability Details
Allocation Without Transfer: The
allocateFundsfunction records allocations in the_allocationsmapping but does not transfer any tokens to the recipient.Withdrawal Restrictions: Only users with the
MANAGER_ROLEcan withdraw funds, meaning recipients cannot access their allocated amounts.
Impact
Users, that had allocated funds, cannot acces their funds.
Recommendations
Transfer Allocated Funds: Modify the
allocateFundsfunction to transfer the allocated funds to the recipient's address.
Lead Judging Commences
What do people do with allocations
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.