# The `RFPSimpleStrategy._registerRecipient()` does not work when the strategy was created using the `useRegistryAnchor=true` causing that nobody can register to the pool

RFPSimpleStrategy._registerRecipient reverts with RECIPIENT_ERROR when useRegistryAnchor=true because recipientAddress is never decoded, blocking all registrations and trapping pool funds.

- Payout: Contest reward
- Severity: medium
- Program: Gitcoin
- Credited: 0xMAKEOUTHILL
- Disclosed: 2023-09-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-09-Gitcoin-judging/issues/245
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-5
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** RFPSimpleStrategy._registerRecipient() in Allo v2
**Root cause:** When useRegistryAnchor is true, the decode branch reads (recipientId, proposalBid, metadata) but never sets recipientAddress, so the later check `recipientAddress == address(0)` reverts with RECIPIENT_ERROR.
**Steps:**
1. Create pool with createPoolWithCustomStrategy using abi.encode(maxBid, true, metadataRequired) so useRegistryAnchor=true.
2. Call allo().registerRecipient(poolId, abi.encode(anchor, 1e18, metadata)).
3. Observe revert RECIPIENT_ERROR(anchor) because recipientAddress remains address(0).
**How found:** Code reading of the two decode branches in _registerRecipient; noticed the useRegistryAnchor=true branch omits recipientAddress, then confirmed with a Foundry test.
**Insight:** When a function branches on a config flag to decode different tuple shapes, check that every variable used downstream is assigned in each branch; a missing assignment in one branch silently zeroes a value and trips a later validation.