Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

[M-2] Untracked Deposit Function in Treasury.sol

player

Description:
In the Treasury.sol contract, the deposit function is publicly accessible, allowing any address to deposit any ERC20 token into the contract. The function only verifies that the token address is non-zero and that the deposit amount is greater than zero. It does not validate the depositor’s identity or confirm whether the token is permitted by the protocol. This lack of controls means that deposits are accepted without tracking the sender’s identity or enforcing protocol-specific token restrictions.

Impact:
This issue could lead to potential mismanagement and auditability challenges. Without proper tracking of depositors, reconciling funds and ensuring compliance with protocol standards becomes difficult. Moreover, accepting any ERC20 token without validation may expose the contract to unintended interactions or misuse, increasing the complexity of fund management and risk analysis.

Proof of Concept:

function deposit(address token, uint256 amount) external override nonReentrant { // @audit: does not check who can deposit and whether the token is valid; any ERC20 token can be deposited
if (token == address(0)) revert InvalidAddress(); // checks if the token address is a non-zero address
if (amount == 0) revert InvalidAmount(); // reverts if the amount is zero
​
IERC20(token).transferFrom(msg.sender, address(this), amount); // transfers tokens from the function caller to the Treasury contract
_balances[token] += amount; // updates the balance
_totalValue += amount; // updates the total value
​
emit Deposited(token, amount); // emits the Deposited event
}

Recommended Mitigation:
Introduce stricter access controls by implementing an appropriate access modifier (e.g., OnlyOwner) if the deposit function is intended for a specific group. Alternatively, if public deposits are acceptable, add a mapping to record the amount of tokens deposited by each address. This enhancement will improve auditability and ensure that only protocol-approved tokens are accepted, aligning the function’s behavior with intended security and operational requirements.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.