Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Alocater may assign wrong amount to recipient because of missing check of amount

bobai23

Summary

In Treasury.sol contract in allocateFunds function if _totalValue >= amountthen that will give correct result. Otherwise _totalValue < amount will give wrong result. Because of that Allocater may assign wrong amount to recipient.

Vulnerability Details

In Treasury.sol contract in allocateFunds function

​
/**
* @notice Allocates funds to a recipient
* @dev Only callable by accounts with ALLOCATOR_ROLE
* Records allocation without transferring tokens
* @param recipient Address to allocate funds to
* @param amount Amount of funds to allocate
*/
function allocateFunds(
address recipient,
uint256 amount
) external override onlyRole(ALLOCATOR_ROLE) {
if (recipient == address(0)) revert InvalidRecipient();
if (amount == 0) revert InvalidAmount();
@>> /* Consider this two situation -
1. `_totalValue >= amount`then function will give correct result.
2. `_totalValue < amount`then function will give wrong result.
​
*/
_allocations[msg.sender][recipient] = amount;
emit FundsAllocated(recipient, amount);
}

Consider this two situation -

  1. _totalValue >= amountthen function will give correct result.

  2. _totalValue < amountthen function will give wrong result.

Impact

Allocater may assign wrong amount to recipient.

Tools Used

Manual Review

Recommendations

In Treasury.sol contract in allocateFunds function add this line if ( _totalValue < amount) revert InsufficientAmount();

function allocateFunds(
address recipient,
uint256 amount
) external override onlyRole(ALLOCATOR_ROLE) {
if (recipient == address(0)) revert InvalidRecipient();
if (amount == 0) revert InvalidAmount();
@> + if ( _totalValue < amount) revert InsufficientAmount();
_allocations[msg.sender][recipient] = amount;
emit FundsAllocated(recipient, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::allocateFunds doesn't say what token you are actually allocating, doesn't check balances, or existing allocations to other recipients

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!