Core Contracts

Summary

The deposit function in the Treasury contract allows any user to deposit tokens without validating the token's behavior. This can lead to a Denial of Service (DoS) attack by using a malicious custom ERC-20 token that can manipulate the _totalValue state variable.

Vulnerability Details

In the deposit function, the contract does not validate the token being deposited. This allows an attacker to create a custom ERC-20 token with specific behaviors that can exploit the treasury's logic.

Step-by-Step Attack Path:

1. Create a Malicious ERC-20 Token: The attacker creates a custom ERC-20 token and mints uint256 max value to their own address.

2. Implement Custom Logic: The attacker includes a transferCounter variable in their token contract, initialized to 0. The _update function is overriden with an if-check such that if transferCounter exceeds 2, the function reverts. The _update function also increments transferCounter by 1 each time it is called.

3. Mint Tokens: The attacker mints tokens to themselves, which sets transferCounter to 1.

4. Deposit Tokens into Treasury: The attacker calls the deposit function in the Treasury contract, transferring their custom tokens with really big number (close to uint256 max value). This call triggers the _update function, incrementing transferCounter to 2.

5. Attempt to Withdraw: The admin attempts to withdraw the tokens from the treasury. However, since the custom token's logic prevents further transfers (as transferCounter cannot exceed 2), the withdrawal fails.

6. Denial of Service: The tokens are now effectively "stuck" in the treasury, and the _totalValue reflects this amount, leading to a situation where the treasury cannot function properly. This results in a Denial of Service for the treasury, as it cannot withdraw or manage its total value.

Impact

This vulnerability can lead to a complete Denial of Service for the treasury, as it can become unable to withdraw or manage funds effectively. The treasury's _totalValue will inaccurately reflect the value of tokens that cannot be utilized.

Tools Used

• Manual code review

Recommendations

Implement a Whitelist of ERC-20 Tokens: Establish a whitelist of approved ERC-20 tokens that can be deposited into the treasury. This whitelist should be managed by an admin, ensuring that only trusted tokens are accepted, thereby mitigating the risk of Denial of Service attacks from malicious tokens.