Fees collected into the `Treasure` by the `FeeCollector` can't be withdrawn
Summary
FeeCollector transfers fees on RAACToken balance updates to the Treasury contract, but there is no way to withdraw them from the treasury.
Vulnerability Details
FeeCollector transfers fees to the treasury and repairFund in the _processDistributions (link) and emergencyWithdraw (link) methods using the SafeERC20's safeTransfer method. Treasury contract has withdraw method that requires balance (link), but FeeCollector does not using deposit method, so balances stored in the Treasury contract will be out of sync with balances stored in the RAACToken contract and withdraw method will throw error InsufficientBalance error.
Impact
All collected fees are useless since they can not be withdrawn from the Treasury's balance.
Tools Used
Manual code review
Recommendations
Don't store balances in the Treasury contract (rely on the token's balances) or use it's deposit/withdraw methods
Lead Judging Commences
FeeCollector::_processDistributions and emergencyWithdraw directly transfer funds to Treasury where they get permanently stuck
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.