Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Risk of `Treasury::_balances` Manipulation by Non-Standard Tokens Due to Missing Balance Verification

zgczgc

Summary

The Treasury::deposit and Treasury::withdraw functions directly use the parameter amount to update _balances without verifying actual balance changes. This creates discrepancies when handling non-standard tokens where transferred amounts may differ from the parameter value. For example, when passing type(uint256).max as amount, a token contract might transfer its actual balance while _balances gets erroneously recorded as type(uint256).max, potentially blocking subsequent withdrawals from manage roles.

Vulnerability Details

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount; <==@found
_totalValue += amount;
emit Deposited(token, amount);
}
​
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
_balances[token] -= amount; <==@found
_totalValue -= amount;
IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}

Impact

  • Balance Record Manipulation: Non-standard tokens can corrupt _balances tracking

  • Withdrawal Functionality Failure: Manager role unable to withdraw actual balances

  • Accounting System Compromise: Financial records become untrustworthy

Tools Used

  • Manual Review

Recommendations

Update _banlance by calculating actual balance changes rather than trusting the amount parameter

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _balances[token] with amount, not taking FoT or rebasing into account

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!