Submission Details
Severity:
user who has a ALLOCATOR_ROLE role can overwrite funds without adding it
Summary
users with the allocator_role can update the funds using the allocatefunds() function. however, since the existing allocated amount is unknown and is replaced by a new value, there is a possibility of mistakes or malicious manipulation
Vulnerability Details
function allocateFunds(
address recipient,
uint256 amount
) external override onlyRole(ALLOCATOR_ROLE) {
if (recipient == address(0)) revert InvalidRecipient();
if (amount == 0) revert InvalidAmount();
_allocations[msg.sender][recipient] = amount;
emit FundsAllocated(recipient, amount);
}
the allocatefunds() function does not update the existing fund amount by adding (+=), but simply overwrites it with =. if a user with fund update privileges makes a mistake, the existing funds could be overwritten
Impact
can easily cause the funds to be manipulated
Tools Used
code review
Recommendations
additionally, verification logic must be added.
Updates
Lead Judging Commences
inallhonesty about 2 months ago
Submission Judgement Published Assigned finding tags:
Treasury::allocateFunds should increase or decrease funds to avoid recipient frontrunning and double spending
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.