Submission Details
Severity:
Allocators cannot withdraw funds from the treasury
Summary
The treasury implements a role based access control, the allocator role has the ability to assign allocations to different users, however the withdraw function only allows the manager to perform such an action:
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
...
This renders useless the funds allocation mechanism.
Vulnerability Details
Impact
Tools Used
Manual review.
Recommendations
Allow allocators to withdraw their allocated funds.
Updates
Lead Judging Commences
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
What do people do with allocations
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.