Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`Treasury` can be DoSed leading to loss of funds

ke1caM

Summary

In Treasury there is no access control in deposit function and there is no whitelist for tokens. User can use custom token that freezes Treasury's functionality.

Vulnerability Details

The deposit function uses _balances to track the balance of the specific token and _totalValue to track all of the tokens that are in the Treasury.

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}

Attacker can create custom token with total supply of maxiumum value of uint256 and implement it in a way that only whitelisted addresses can transfer the token. Then the attacker has to approve the token and call deposit. _totalValue will be set to maximum value of uint256 so any more tokens can't be deposited.

The tokens can't be transfered since the attacker can whitelist the addresses that are allowed to tranfer tokens.

Tokens can't be removed using withdraw since it uses transfer function.

function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
_balances[token] -= amount;
_totalValue -= amount;
IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}

Impact

Attacker can freeze the Treasury preventing deposits and withdrawals leading to loss of funds.

Tools Used

Manual Review, Hardhat

Recommendations

Create whitelist for tokens so that custom tokens can't be used to freeze the Treasury.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.