Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of sanity checks on _totalValue updates

kineticsofweb3

Summary

The Treasury contract's _totalValue tracking system lacks essential sanity checks and business logic constraints, allowing for uncontrolled value growth and potential protocol destabilization. This vulnerability could lead to unrealistic total values and disrupt the protocol's economic model.

Vulnerability Details

The _totalValue variable is updated without proper constraints in two critical functions:

  1. deposit function:

_totalValue += amount;

No validation of total value growth rate or maximum limits.
2. withdraw function:

_totalValue -= amount;

No protection against rapid sequential withdrawals or negative value accumulation.

Impact

The vulnerability could lead to several critical issues:

  1. Unrealistic total value growth through compound operations

  • Potential protocol destabilization

  • No protection against rapid sequential operations

Tools Used

  • Decimal arithmetic for precise financial calculations

  • Automated testing of compound growth scenarios

Recommendations

  1. Implement Maximum Value Constraints

uint256 public constant MAX_TOTAL_VALUE = 1e28 \* 1e18; // Example maximum
​
function deposit(address token, uint256 amount) external override nonReentrant {
require(_totalValue + amount <= MAX_TOTAL_VALUE, "Total value exceeds maximum");
_totalValue += amount;
}

  1. Add Rate Limiting

uint256 public constant MAX_VALUE_CHANGE_RATE = 10%; // 10% per block
uint256 public lastValueUpdate;
uint256 public lastValue;
​
function updateValue(uint256 newValue) internal {
uint256 currentTime = block.timestamp;
require(currentTime >= lastValueUpdate + 1, "Rate limit not expired");
uint256 timeElapsed = currentTime - lastValueUpdate;
uint256 maxAllowedChange = lastValue * (MAX_VALUE_CHANGE_RATE * timeElapsed);
require(abs(newValue - lastValue) <= maxAllowedChange, "Exceeds rate limit");
lastValueUpdate = currentTime;
lastValue = newValue;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!