Submission Details
Severity:
No Function to Revoke Roles in Treasury Contract Leading to Irreversible role assignment
Finding description and impact
Once a role is granted to an address, it cannot be revoked. This poses security risks if a privileged address is compromised.
Proof of Concept
The contract lacks a
revokeRolefunction.
Recommended mitigation steps
Implement a revokeRole function to allow removal of roles when needed.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.