Core Contracts

Summary

The function applyTreasuryUpdate() updates the treasury address to a new one after a timelock period. However, the function does not handle the transfer of collected fees from the old treasury to the new treasury before updating the address. This could lead to potential fund mismanagement if there are remaining balances in the old treasury that are not explicitly transferred to the new address before the update.

Vulnerability Details

The contract has 2 functions that intend to add funds into the treasury address:

• emergencyWithdraw: which would cause all the funds from the current contract to be transferd to the treasury.

• distributeCollectedFees: which automaticlly calls _processDistributions distributes collected fees to treasury, repairFund and some of them are burned.

If funds are send to the treasury and they are not used by the time applyTreasuryUpdate is called, the funds get stuck in the old treasury address and are not transfered to the new one.

Code sniped is found in 2025-02-raac\contracts\core\collectors\FeeCollector.sol on lines 306-312

Impact

Loss or misallocation of protocol fees.

Tools Used

Manual review

Recommendations

To mitigate this issue, modify applyTreasuryUpdate() to include logic that transfers all collected fees from the old treasury to the new treasury before updating the address. That is completely necessary every time a treasury is changed (even if the contract uses/distributes the fees in another function).

Suggested implementation:

Benefits of Fix:

• Ensures that collected fees remain within the protocol’s control and are not stranded in an old treasury.

• Enhances security by ensuring that the new treasury starts with the correct funds.

Risk Assessment:

Severity: High

Reasoning:
If the fees collected by the treasury aren't properly transferred to the new address before updating it (that is always the case when calling applyTreasuryUpdate()), there is a risk that those funds could be lost. This is a significant issue, especially if the treasury holds substantial amounts of funds. The loss of fees would directly impact the contract’s ability to distribute or use those funds, which could be catastrophic for the contract’s intended functionality.