Core Contracts

Summary

The Treasury contract's _totalValue aggregates token values without accounting for different token decimals, leading to incorrect total value calculations and potential economic issues.

Vulnerability Details

The Treasury contract maintains a _totalValue variable that tracks the total value of all tokens held. However, it naively adds token amounts without normalizing for decimal differences:

Example scenario:

1. Deposit 1 WBTC (8 decimals) = 100,000,000 (1e8)

2. Deposit 1 USDC (6 decimals) = 1,000,000 (1e6)

3. _totalValue = 101,000,000

This is incorrect because:

• 1 WBTC = 100,000,000 (1e8)

• 1 USDC = 1,000,000 (1e6)

• The values are added directly without considering their different decimal bases

• Results in meaningless total that doesn't represent actual value

Impact

1. Incorrect Total Value Reporting: The getTotalValue() function returns inaccurate aggregated values

2. Skewed Protocol Metrics: Any protocol decisions or calculations based on _totalValue will be incorrect

3. Economic Implications: If protocol uses _totalValue for:

   • Fee calculations

   • Risk assessments

   • Protocol health metrics

   • Treasury-based decisions
     All would be based on incorrect data

Severity: MEDIUM

• Doesn't lead to direct fund loss

• But affects protocol metrics and decision-making

• Could indirectly impact economic decisions

Tools Used

Manual Review

Recommendations

Track values separately:

1. Consider adding:

   • Decimal tracking for each token

   • Value normalization functions

   • Clear documentation about value representations

   • Separate getters for normalized and raw values