Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Input Validation in emergencyWithdraw

0x0107

Summary

The emergencyWithdraw function in BaseGauge.sol does not validate the token address or amount before transferring funds. This could lead to:

  1. Invalid token addresses being used, causing transaction failures.

  2. Zero or excessive amounts being withdrawn, leading to unintended behavior.

Vulnerability Details

The emergencyWithdraw function currently allows the DEFAULT_ADMIN_ROLE to withdraw any token and amount from the contract:

function emergencyWithdraw(address token, uint256 amount) external onlyRole(DEFAULT_ADMIN_ROLE) {
IERC20(token).safeTransfer(msg.sender, amount);
}
​

No Check for Valid Token Address

  • If an invalid token address (address(0)) is passed, the function could fail silently or cause unexpected behavior.

No Check for Valid Amount

  • If amount == 0, it wastes gas with an unnecessary transaction.

  • If amount > contract balance, the transaction will revert, potentially disrupting emergency operations.

Impact

Invalid token addresses can cause unexpected reverts or failures.

If a malformed transaction is executed in an emergency, it could disrupt fund recovery.

Allowing zero-value transactions leads to unnecessary gas costs.

Tools Used

Manual Review

Recommendations

Modify the emergencyWithdraw function to validate inputs before execution.

function emergencyWithdraw(address token, uint256 amount) external onlyRole(DEFAULT_ADMIN_ROLE) {
// add check
require(token != address(0), "Invalid token address");
require(amount > 0, "Invalid withdraw amount");
require(IERC20(token).balanceOf(address(this)) >= amount, "Insufficient contract balance");
​
IERC20(token).safeTransfer(msg.sender, amount);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.