Allo.registerRecipient() is not necessary to be a payable function

Since Allo.registerRecipient() does not pass the msg.value to the strategy, this function is not necessary to be a payable function. The received ETH via this function should only be refunded without triggering any effective logic.

Vulnerability Detail

Impact

The Allo contract would receive mistakenly sent ETH via registerRecipient().

Code Snippet

    function registerRecipient(uint256 _poolId, bytes memory _data) external payable nonReentrant returns (address) {
        // Return the recipientId (address) from the strategy
        return pools[_poolId].strategy.registerRecipient(_data, msg.sender);
    }

Tool used

Manual Review

Recommendation

Remove the payable keyword

sherlock-audit / 2023-09-Gitcoin-judging