Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of Standardization in `_totalValue` Calculation Across Different Tokens

waydou

Summary

The deposit and withdraw functions incorrectly aggregate the total value of tokens (_totalValue) without considering token decimals or exchange rates. This could lead to inaccurate financial tracking and misrepresentation of the contract’s actual holdings.

Vulnerability Details

The contract tracks _totalValue by summing deposited token amounts directly:

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}

  1. Ignoring Token Decimals: Different ERC-20 tokens have different decimal places (e.g., USDC has 6 decimals while WETH has 18). Summing raw values without standardization results in misleading total value calculations.

  2. Lack of Exchange Rate Consideration: Tokens have varying values in the market. Treating them as equivalent in _totalValue misrepresents the actual asset value.

3, Inaccurate Reporting: The getTotalValue function may provide misleading information, potentially affecting financial decision-making or automated strategies relying on this metric.

Impact

Incorrect _totalValue tracking can lead to financial discrepancies and misinformed decision-making.

Tools Used

Manual review

Recommendations

Implement a system to convert token amounts into a common unit of measure (e.g., using Chainlink price feeds for conversion

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.