Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Tokens can be permanently locked in the Treasury contract

damilolaedwards

Target

contracts/core/collectors/Treasury.sol

Vulnerability Details

The withdraw function in the Treasury contract is responsible for managing token withdrawals from the the contract, it updates its internal accounting of total value of tokens in the contract (_totalValue) and the balance of the token remaining in the contract (_balances[token]).

function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
_balances[token] -= amount;
_totalValue -= amount;
IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}

Treasury.withdraw

However, since tokens directly transferred into the contract (without using the deposit function) are not accounted for internally, they would not be able to be withdrawn using the withdraw function since that would lead to an underflow when deducting the amount from the token balances tracked internally within the contract.

Impact

Tokens transferred to the contract directly (intentionally or mistakenly) will be ultimately locked even though the withdraw function can withdraw any token from the contract.

Tools Used

Manual Review

Recommendations

Refactor the internal token accounting to take into consideration that tokens can be directly transferred to the treasury contract (without using the deposit function) hence allowing withdrawals of entire balances.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!