Submission Details
Severity:
Allocators cannot withdraw funds from the treasury
Summary
The treasury implements a role based access control, the allocator role has the ability to assign allocations to different users, however the withdraw function only allows the manager to perform such an action:
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
...
This renders useless the funds allocation mechanism.
Vulnerability Details
Impact
Tools Used
Manual review.
Recommendations
Allow allocators to withdraw their allocated funds.
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
What do people do with allocations
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.