Submission Details
Severity:
User can loss his funds if token transfer is unsuccesful to recipient.
Summary
Code snippet of Treasury.sol::withdraw.
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
_balances[token] -= amount;
_totalValue -= amount;
@ -> IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}
transfer() function will not revert, even if tranfer is unsuccesful.
Vulnerability Details
User hits
withdrawfunction.transfer of funds to recipeint is unsucessful, due to some reason, but no revert.
_balances[token] -= amount;changed. but it shouldn't.
Impact
Internal accounting and actual balance discrepancy.
Tools Used
Manual
Recommendations
Use openzepplin safeTransfer instead.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.