Core Contracts

Vulnerability Details

the allocateFunds function in the Treasury.sol incorrectly overwrites _allocations mapping instead of updating/adding to it.

When the allocateFunds function is called by the trusted role for allocating funds to a specifies receppient. When the mapping is updated in the function i.e alllocations instead of adding to it the mapping is bieng overwritten instead. For example lets say the owner allocates 100 tokens to a receipient and then some time later to the same reciepient the owner wants his allocation to be 150 so he next time calls the function with amount = 50 bu instead of adding in the allocations mapping to 150, it will be updated to 50.

Recommendations

Update the code like this :
+_allocations[msg.sender][recipient] += amount;
-_allocations[msg.sender][recipient] = amount;

Code Snippets