Core Contracts

Summary

1. The lack of state tracking in the deposit function is a high severity issue that can lead to potential misallocation of funds and loss of user confidence. Implementing state tracking and ensuring the connection between the deposit and allocateFunds functions are essential to address this issue and enhance the security and reliability of the contract.

Vulnerability Details:

The deposit function in the Treasury contract does not track or change the state to indicate which msg.sender deposited the amount of tokens. This leads to several critical issues, including the inability to verify individual user deposits and the potential misallocation of funds. The deposit function and the allocateFunds function are not connected, meaning that after a user deposits funds, there is no guarantee that the funds will be allocated to the same user. This undermines the security and reliability of the contract, leading to potential financial losses and loss of user confidence.

Impact

• Financial Loss: Users may lose their deposited funds if the allocator allocates the funds to another user.

• Loss of Trust: Users cannot trust that their deposited funds will be correctly tracked and allocated, leading to a loss of confidence in the contract.

• Security Risk: The lack of state tracking and connection between the deposit and allocateFunds functions poses a significant security risk.

Tools Used

Manual reviews

Recommendations

1. State Tracking: Implement state tracking to record deposits made by each user (msg.sender). This can be done using a mapping to store the deposited amounts for each user.

2. Connection Between Functions: Ensure that the deposit function and the allocateFunds function are connected, so that funds deposited by a user are allocated to the same user.

3. Audit and Testing: Conduct a thorough audit and testing of the contract to ensure that the state tracking and allocation logic are correctly implemented and secure.

   function deposit(uint256 amount) external {

   require(amount > 0, "Amount must be greater than zero");

   deposits[msg.sender] += amount;

   // Transfer the tokens from the user to the contract

   require(token.transferFrom(msg.sender, address(this), amount), "Transfer failed");

   emit Deposit(msg.sender, amount);

   }