Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect tracking of _totalValue

kwakudr

Summary

Simple addition of token amounts without consideration of decimals or value could lead to inaccurate total value calculations. _totalValue doesn't account for token values relative to each other.

Vulnerability Details

contract Treasury is ITreasury, AccessControl, ReentrancyGuard {
// Access control roles
bytes32 public constant MANAGER\_ROLE = keccak256("MANAGER\_ROLE"); // Can withdraw funds
bytes32
​
constant ALLOCATOR_ROLE = keccak256("ALLOCATOR_ROLE"); // Can allocate funds
// State variables
mapping(address => uint256) private _balances; // Token balances
mapping(address => mapping(address => uint256)) private _allocations; // Allocator => recipient => amount
uint256 private _totalValue; // Total value across all tokens
function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
​
// - No validation of token decimals
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
}

There is no validation of token decimals. All tokens deposits are added to totalvalue without normalizing them to one token like USD. This is incorrect because the protocol accepts different tokens for deposits. some of these tokens have different decimals. These decimals have to be normalized before adding them to totalValue but the system doesn't do that.

Example:

Tokens have vastly different values (1 WBTC ≠ 1 USDC)

  • Decimals vary (USDC: 6, WETH: 18)

  • Some tokens are highly volatile

  • Some tokens may be rebasing tokens whose balance changes over time.

_totalValue now represents meaningless sum of different decimal places

Impact

Incorrect tracking of _totalValue

Tools Used

Foundry

Recommendations

Implement the correct tracking of tokens and their decimals.

struct TokenInfo {
uint256 balance;
uint8 decimals;
address priceOracle;
}

mapping(address => TokenInfo) private _tokenInfo;

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.