modifier balancedBooks missing in a few functions

[code423n4]

Handle

gpersoon

Vulnerability details

Impact

Most of the functions of RCTreasury.sol, that manipulate totalDeposits, marketBalance or totalMarketPots use the modifier balancedBooks.
However the functions refundUser and topupMarketBalance don't use the modifier.
It doesn't hurt to add the extra safeguard.

Proof of Concept

// https://github.com/code-423n4/2021-06-realitycards/blob/main/contracts/RCTreasury.sol#L124
/// @notice check that funds haven't gone missing during this function call
modifier balancedBooks {
_;
// using >= not == in case anyone sends tokens direct to contract
require(erc20.balanceOf(address(this)) >= totalDeposits + marketBalance + totalMarketPots,"Books are unbalanced!");
}

// https://github.com/code-423n4/2021-06-realitycards/blob/main/contracts/RCTreasury.sol#L447
function refundUser(address _user, uint256 _refund) external override onlyMarkets {
marketBalance -= _refund;
...
totalDeposits += _refund;

// https://github.com/code-423n4/2021-06-realitycards/blob/main/contracts/RCTreasury.sol#L372
function topupMarketBalance(uint256 _amount) external override {
....
marketBalance += _amount;
}

Tools Used

Recommended Mitigation Steps

Add the modifier balancedBooks to the functions refundUser and topupMarketBalance

[mcplums]

This is a good one- thanks @gpersoon :)

[Splidge]

implemented here

[dmvt]

I agree with @0xRajeev in #112 that this should be medium severity. The likelihood is low but the potential impact could be quite high.

[dmvt]

duplicate of #112