Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

When allocating funds, the kind of allocated funds is no set.

kupiasec

Summary

The Treasury.allocate() function allocates funds to recipients. However, the kind of allocated funds is not set. Therefore, recipients cannot take allocated funds from the treasury.

Vulnerability Details

Any kind of token can be deposited in the treasury.
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/collectors/Treasury.sol#L46-L55

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}

In the allocate() function, however, only the recipient and amount are given, while the kind of allocated funds is not set.
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/collectors/Treasury.sol#L87-L96

function allocateFunds(
@> address recipient,
@> uint256 amount
) external override onlyRole(ALLOCATOR_ROLE) {
if (recipient == address(0)) revert InvalidRecipient();
if (amount == 0) revert InvalidAmount();
​
_allocations[msg.sender][recipient] = amount;
emit FundsAllocated(recipient, amount);
}

Therefore, the protocol cannot know which token is allocated to a specific recipient.

Impact

Funds of the treasury cannot be exactly allocated to recipients.

Recommendations

When allocating funds, the kind of allocated funds should be set.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::allocateFunds doesn't say what token you are actually allocating, doesn't check balances, or existing allocations to other recipients

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!