Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Treasury _totalValue does not take into account decimals and value of the tokens

bakhankov

Summary

The _totalValue variable in the Treasury contract does not take into account the decimals and value of the tokens. This can lead to incorrect calculations.

Vulnerability Details

Considering that different tokens have different values ​​and different numbers of decimal places, i.e. the value of 1 USD in tokens such as USDC, DAI and WETH will not be the same:

$1 = 1e6 USDC

$1 = 1e18 DAI

$1 = 373e12 WETH

It will lead to situations where the _totalValue variable will not represent the actual value of the tokens in the contract.

/contracts/core/collectors/Treasury.sol

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
@> _totalValue += amount;
emit Deposited(token, amount);
}

Impact

Since actual value of deposited tokens is not checked, the _totalValue variable can be manipulated by depositing tokens with different or no value.
Any calculations based on the _totalValue variable will be incorrect.

Recommendations

Total value calculation need an oracle to be introduced to get the value of the token. This will allow the contract to calculate the total value of the tokens correctly.

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
+ _totalValue += amount * oracle.getPrice(token);
- _totalValue += amount;
emit Deposited(token, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.