Submission Details
Severity:
Attacker can overflow the _totalValue and DOS deposits
Summary
Attacker can send fake tokens to the treasury and DOS deposis.
Vulnerability Details
The deposit function allow tokens to be deposited into the protocol
function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}
With the current implementation, attacker can create fake ERC20 token with high decimals then deposit to overflow the _totalValue, this will mean that no other tokens can be deposited again.
Impact
Deposits to the treasury can be DOS
Tools Used
Manual review
Recommendations
_totalValue is a redundant variable consider removing it.
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.