Submission Details
Severity:
Allocations are meant to be immutable after initialization in `RAACReleaseOrchestrator`
Summary
Allocations are meant to be immutable after initialization in RAACReleaseOrchestrator but there is a function that allows changing it after initialization.
Vulnerability Details
From DOCS: Category allocations are immutable after initialization.
Function from RAACReleaseOrchestrator contract.
function updateCategoryAllocation(
bytes32 category,
uint256 newAllocation
) external onlyRole(DEFAULT_ADMIN_ROLE) {
if (categoryAllocations[category] == 0) revert InvalidCategory();
if (newAllocation < categoryUsed[category]) revert InvalidAmount();
categoryAllocations[category] = newAllocation;
emit CategoryAllocationUpdated(category, newAllocation);
}
We can see that allocation can be set after initialization.
Impact
Allocation can be changed after initialization which breaks protocol expected functionality.
Tools Used
Manual Review, Hardhat
Recommendations
Remove this function or change the docs if the allocations are meant to be changed.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.