Core Contracts

Summary

• Track fund allocations and balances

  https://docs.raac.io/core/collectors/Treasur

  In the real sense, there is no allocation of funds to recipient. Only update a mapping.

Vulnerability Details

The allocateFunds function in the Treasury contract is expected to track funds allocation. However, it does not specifically allocate any funds/token to users when the ALLOCATOR role invokes the function. Compared to the deposit and withdraw functions, which are one existing alternative functions to deposit any kind of token to the contract, and the ability to withdraw any kind of tokens. The allocateFunds only simply updates a state variable with no corresponding functions for allocated recipients to receive allocations. Only a mapping gets updated.

deposit <-----------------> withdraw

allocateFunds <-------> ?

```solidity

Impact

No real allocation of funds to recipient. Just state update.

Tools Used

Manual review.

Recommendations

Rename the function if the primary purpose is to track only a figure given to users. If this is to allocate funds for which users can claim from in the future, then design the allocateFunds to allocate tokens and add function for the recipients to claim allocate funds from the treasury. Consider the token type while allocating tokens to recipients.