Summary

The allocateFunds() function in the Treasury.sol contract incorrectly overwrites the allocation amount for recipients rather than adding to the existing balance. This leads to the previous allocation being lost each time the function is called, causing issues with accurate fund tracking and potentially misallocating treasury funds.

Vulnerability Details

Issue: Allocation Amount Gets Overwritten Instead of Incremented

Code Example from Treasury.sol:

Expected Behavior:

When allocating funds to a recipient, the new allocation amount should be added to any previous allocations for that recipient, allowing the total allocation to accumulate over time.

Actual Behavior:

Instead of adding to the previous allocation, the function directly assigns the new amount, replacing any prior allocation.

Problems Caused by This Issue:

1. Loss of Previous Allocations: Each call to allocateFunds() erases the prior allocated amount, which leads to incomplete or incorrect fund tracking.

2. Inaccurate Fund Distribution: Allocators might unknowingly override funds that have already been allocated, resulting in improper distribution of the treasury's resources.

Impact

• Inconsistent Fund Records: Allocations will not accumulate correctly, causing discrepancies in the treasury's allocation records.

• Potential loss of old allocation: If funds are meant to be distributed progressively, each allocation will overwrite the previous one, leading to the loss of previous amounts.

Tools Used

• Manual Code Review

Recommendations

1. Modify allocateFunds() to Accumulate Allocations Instead of Overwriting:

   To ensure allocations are properly accumulated, modify the function to add the new amount to the existing value for that recipient.

   function allocateFunds(

   address recipient,

   uint256 amount

   ) external override onlyRole(ALLOCATOR_ROLE) {

   if (recipient == address(0)) revert InvalidRecipient();

   if (amount == 0) revert InvalidAmount();

   _allocations[msg.sender][recipient] += amount; // Add to existing allocation

   emit FundsAllocated(recipient, _allocations[msg.sender][recipient]);

   }