Fund missmanagement in `Treasury`
Summary
The FeeCollector contract directly transfers RAAC tokens to the Treasury contract using safeTransfer instead of utilizing the Treasury's deposit function. This direct transfer prevents the Treasury from properly processing and tracking the received funds, leading to fund losses.
Vulnerability Details
In FeeCollector, the emergencyWithdraw (and also other functions) contains:
This direct transfer bypasses the Treasury's deposit function and as a result the _balances mapping in Treasury doesn't get updated, which means the tokens are permanently locked in the contract.
Impact
Due to this vulnerability, the manager will not be able to withdraw the tokens transferred to Treasury, resulting in a permanent loss of all tokens transferred from FeeCollector, with no way of recovery.
Recommendations
Consider modifying FeeCollector to transfer tokens to Treasury through the deposit function.
Lead Judging Commences
FeeCollector::_processDistributions and emergencyWithdraw directly transfer funds to Treasury where they get permanently stuck
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.