Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

[Treasury.deposit(address,uint256)] ignores return value

johnweb3

Summary

The deposit function in Treasury.sol ignores the return value of the ERC20 transferFrom call, which can lead to incorrect state updates if the token transfer fails.

Vulnerability Details

Within the deposit function the following call is made without checking its return value:

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}

If this call fails (i.e., returns false), the contract will proceed as if the tokens were successfully transferred, resulting in a discrepancy between recorded deposits and actual token balances.

Impact

  1. inconsistent State: The Treasury may record deposits without actually receiving tokens.

  2. Financial Risk: Users might lose funds or not receive the expected benefits, as the contract's balance becomes inaccurate.

This vulnerability is likely to manifest when interacting with ERC20 tokens that return false on failure rather than reverting, which is a common behavior among non-standard implementations.

An attacker (or even a regular user) could exploit this by depositing tokens from a token contract where transferFrom fails silently (returns false). The Treasury contract would record a deposit even though no tokens were received, leading to misallocated funds.

Tools Used

github

Recommendations

Always verify the return value of the transferFrom call. For example, modify the code as follows:

function deposit(address token, uint256 amount) external {
// ... (other logic)
require(IERC20(token).transferFrom(msg.sender, address(this), amount), "TransferFrom failed");
// ... (other logic)
}
​

This ensures that the function reverts if the token transfer fails, maintaining consistency in the contract's state.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Known issue
inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.