Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Unrestricted Token Deposits Allow DoS via Malicious ERC-20 with Reverting Transfers in `Treasury` Contract

0xaadi

Summary

In Treasury, the lack of safeguards for unsupported ERC-20 tokens allows an attacker to inflate _totalValue to the maximum value, effectively preventing further legitimate deposits due to an overflow issue, leading to a denial-of-service (DoS) attack.

Vulnerability Details

An attacker can create a malicious ERC-20 token that always reverts in transfer().

Malicious Token Example

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
​
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
​
contract MaliciousToken is ERC20 {
constructor() ERC20("MaliciousToken", "MAL") {
_mint(msg.sender, type(uint256).max);
}
function transfer(address recipient, uint256 amount) public override returns (bool) {
revert("Transfer failed");
}
}

The attacker then deposits the maximum possible token amount (type(uint256).max) into the treasury contract. As _totalValue is incremented with each deposit, this results in an inflated _totalValue value.

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
@> _totalValue += amount;
emit Deposited(token, amount);
}

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/collectors/Treasury.sol#L46C5-L55C6

Since _totalValue is used to track the total deposited assets, further deposits may be prevented due to overflow issues, causing a DoS condition.

Impact

  • The treasury contract is rendered unusable as _totalValue becomes an unmanageable large value.

  • Legitimate users are unable to deposit further funds.

Tools Used

Manual Review

Recommendations

  • Implement token allowlist or validation to ensure only supported tokens can be deposited.

  • OR add access controll to deposit()to allow only whitelisted users to deposits funds.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!