Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack Role Check in `applyTreasuryUpdate()`

maglov

Summary

The function applyTreasuryUpdate do not enforce proper role-based access control, allowing unauthorized users to update treasury address. This could lead to funds being redirected to malicious addresses, resulting in potential financial loss.

Impact

  1. Unauthorized Fund Redirection: Malicious actors could update treasury addresses, diverting protocol funds.

  2. Protocol Manipulation: Attackers could exploit this vulnerability to disrupt normal operations and governance.

Tools Used

Manual Review

Recommendations

Restrict Access: Use OpenZeppelin’s AccessControl or Ownable to ensure only authorized roles (e.g., ADMIN_ROLE) can call this function.

function applyTreasuryUpdate() external onlyRole(ADMIN_ROLE) {
if (pendingTreasury.newAddress == address(0)) revert InvalidAddress();
if (block.timestamp < pendingTreasury.effectiveTime) revert UnauthorizedCaller();
treasury = pendingTreasury.newAddress;
delete pendingTreasury;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.