Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Emergency withdraw tokens from FeeCollector stuck in Treasury forever

heliosophistxiv

Summary

FeeCollector implements an emergency withdrawal function that transfers tokens to treasury. However, treasury keeps a separate accounting of token balances which is only updated when deposit is called. Because of that, the unaccounted tokens can never be withdrawn from the treasury.

Vulnerability Details

FeeCollector.sol:L269 implements the emergencyWithdraw function:

function emergencyWithdraw(address token) external override whenPaused {
if (!hasRole(EMERGENCY_ROLE, msg.sender)) revert UnauthorizedCaller();
if (token == address(0)) revert InvalidAddress();
​
uint256 balance;
if (token == address(raacToken)) {
balance = raacToken.balanceOf(address(this));
raacToken.safeTransfer(treasury, balance);
} else {
balance = IERC20(token).balanceOf(address(this));
SafeERC20.safeTransfer(IERC20(token), treasury, balance);
}
​
emit EmergencyWithdrawal(token, balance);
}

However, Treasury has a separate deposit-withdraw logic that uses an internal accounting to keep track of token balances:

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}
​
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
_balances[token] -= amount;
_totalValue -= amount;
IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}

Since the balances are not updated, withdrawal will be impossible and tokens will be stuck in the contract.

Impact

Tokens transferred will be forever lost.

Tools Used

  • Manual review

Recommendations

Use the deposit(address token, uint256 amount) function on the Treasury contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::_processDistributions and emergencyWithdraw directly transfer funds to Treasury where they get permanently stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!