Summary

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/collectors/Treasury.sol#L46-L55

Anyone can call deposit with any token and amount.

Attacker can create a ERC20 token and mint himself uint256.max tokens.

Then, he would approve anddeposit 2^256 - 1 - _totalValue of his custom token, which would set _totalValue to 2^256 - 1.

The next deposit would revert because _totalValue can not be increased due to implicit uint256 overflow check.

Impact

deposit is blocked for any tokens until manager calls withdraw, after which the attacker can repeat the attack.

DoS of deposit on any chain with frontrunning (public mempool): the attacker can frontrun legit deposit and make it revert.

Recommendations

Whitelist tokens which can be deposited, or remove _totalValue from the contract.