Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Allocation Check

ChainDefenders

Summary

In the Treasury.sol contract the withdraw function is missing an allocation check and update for the recipient, which can lead to improper management of allocated funds.

Vulnerability Details

The vulnerability arises from the absence of a check for allocated funds in the withdraw function. When a withdrawal is made, the function does not verify if the recipient has an allocated amount and does not update the allocation accordingly. This can result in allocated funds being withdrawn without proper tracking, leading to discrepancies in fund management.

Impact

Without proper allocation checks and updates, the protocol will allow withdrawals that exceed the allocated amounts, leading to potential financial mismanagement. Allocated funds are intended to be reserved for specific purposes or recipients, and bypassing this mechanism can result in funds being misused or depleted prematurely. This undermines the integrity of the fund allocation system and can lead to financial losses for the protocol and its users.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, implement an allocation check and update in the withdraw function. This ensures that withdrawals respect the allocated amounts and properly update the allocation records. Here is an example of how to implement this:

function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
​
// Check and update allocation
uint256 allocatedAmount = _allocations[msg.sender][recipient];
if (allocatedAmount < amount) revert InsufficientAllocation();
_allocations[msg.sender][recipient] -= amount;
​
_balances[token] -= amount;
_totalValue -= amount;
IERC20(token).transfer(recipient, amount);
​
emit Withdrawn(token, amount, recipient);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::withdraw doesn't check if one withdraws more than the needed balance for current allocations, doesn't update the _totalValue properly

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::withdraw doesn't check if one withdraws more than the needed balance for current allocations, doesn't update the _totalValue properly

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::allocateFunds doesn't say what token you are actually allocating, doesn't check balances, or existing allocations to other recipients

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!