Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Emergency withdrawal transfers tokens to treasury instead of depositing which leaves them stuck

OpaBatyo

Summary

If the owners initiate an emergency withdrawal of assets from the FeeCollector contract, it just transfers them to the treasury instead of depositing them, rendering them stuck.

Vulnerability Details

In case of emergency, the protocol owners can call emergencyWithdraw() in the FeeCollector contract to save their assets and send them to the treasury, the issue is that it simply makes a transfer, rather than depositing them into the treasury:

function emergencyWithdraw(address token) external override whenPaused {
...
​
uint256 balance;
if (token == address(raacToken)) {
balance = raacToken.balanceOf(address(this));
@> raacToken.safeTransfer(treasury, balance);
} else {
balance = IERC20(token).balanceOf(address(this));
@> SafeERC20.safeTransfer(IERC20(token), treasury, balance);
}
​
emit EmergencyWithdrawal(token, balance);
}

The transferred tokens will not be accounted for internally inside the treasury which will render them stuck. The correct way to transfer into the treasury is by calling the deposit() function:

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}

The treasury contract does not have any other functions to transfer out the tokens or use them which will render them stuck since they will not be accounted for in the _balances[token] mapping.

Impact

All funds transferred from emergency withdrawals from the FeeCollector to the Treasury will be stuck.

Tools Used

Manual Review

Recommendations

Deposit them with deposit() instead of just transferring them.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::_processDistributions and emergencyWithdraw directly transfer funds to Treasury where they get permanently stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!