Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`Treasury` contract can't handle rebase tokens

ke1caM

Summary

When tokens are deposited into Treasury the _balances state variable in increased based on amount parameter. If the real amount transfered to the contract changes it can't be withdrawn which leads to loss of funds.

Vulnerability Details

If we look at the deposit function is adds amount to _balances state variable.

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}

If the manager wants to withdraw the tokens he must call withdraw. Manager can only withdraw the amount of tokens stored in _balances state variable. The issue is that some tokens rebase their balanceOf over time. It means that the balance can change from 100 to 110 but the manager can only withdraw original 100 tokens. Rest of the tokens is forever stuck in the contract leading to loss of funds.

function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
_balances[token] -= amount;
_totalValue -= amount;
IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}

Impact

Rebase tokens will be forever stuck in the contract if balanceOf increases overtime.

Tools Used

Manual Review, Hardhat

Recommendations

Change Treasury contract so that manager can withdraw balanceOf of the specified token.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _balances[token] with amount, not taking FoT or rebasing into account

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.