Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Fund Allocation Overwrite Vulnerability in Treasury contract

0xblackadam

Description

In the Treasury contract, the allocateFunds function overwrites previous allocations instead of updating them, leading to potential loss of allocation history and incorrect fund tracking.

Vulnerable code:

function allocateFunds(
address recipient,
uint256 amount
) external override onlyRole(ALLOCATOR_ROLE) {
if (recipient == address(0)) revert InvalidRecipient();
if (amount == 0) revert InvalidAmount();
_allocations[msg.sender][recipient] = amount;
emit FundsAllocated(recipient, amount);
}

Impact

  • Previous allocations are lost without any record

  • No tracking of cumulative allocations

  • Potential for accounting errors

  • Loss of allocation history

  • Difficulty in auditing allocation patterns

  • Could lead to double-spending or under-allocation of funds

Proof of Concept

Add this test script to the Fund Allocation test script in test/unit/core/collectors/Treasury.test.js

it("test for allocation overwrite", async () => {
const amount = ethers.parseEther("100");
await treasury.connect(allocator).allocateFunds(user1.address, amount);
expect(await treasury.getAllocation(allocator.address, user1.address))
.to.equal(amount);
const newAmount = ethers.parseEther("50");
​
await treasury.connect(allocator).allocateFunds(user1.address, newAmount);
​
expect(await treasury.getAllocation(allocator.address, user1.address))
.to.equal(newAmount);
// instead of the user1 allocated amount to be 150 (amount + newAmount), it is the newAmount(50)
});

Fix Recommendations

  1. Add cumulative allocation tracking:

  2. Add allocation adjustment functionality:

Tools Used

  • Manual code review

  • Foundry Testing Framework

  • Static analysis

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::allocateFunds should increase or decrease funds to avoid recipient frontrunning and double spending

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.