Summary

The Treasury.sol contract documentation states that it supports multi-token deposits. Given this claim, the contract is expected to work seamlessly with various ERC-20 tokens, including stablecoins like USDC and USDT. However, the contract uses transferFrom instead of safeTransferFrom in the deposit() function, which can lead to failed transfers and funds getting stuck.

Vulnerability Details

Issue: transferFrom May Not Work Reliably for Certain Tokens

The contract uses IERC20(token).transferFrom(msg.sender, address(this), amount); to transfer tokens. This is problematic for tokens that do not fully comply with the ERC-20 standard, such as USDT (Tether), which does not return a boolean value upon transfer.

Problems Caused by This Issue:

1. Silent Transaction Failures: Some tokens, like USDT, do not return true/false on transferFrom(), and the transaction might succeed without proper validation, leading to unexpected behavior.

2. Funds Getting Stuck: If the transfer fails and the function does not revert, the _balances mapping may be updated incorrectly, creating a discrepancy between the stored balance and actual token holdings.

3. Inconsistent Multi-Token Support: While the contract documentation claims to support multiple tokens, its implementation does not account for variations in token behavior, potentially breaking compatibility with major stablecoins.

Impact

• Potential Loss of Funds: Users may believe their deposit succeeded while the actual token transfer failed.

• Incompatibility with Stablecoins: Popular stablecoins like USDT may not function properly, limiting the usability of the treasury.

• Risk of Incorrect Balance Accounting: The contract might reflect a deposit that never actually occurred, leading to misreported treasury holdings.

Tools Used

• Manual Code Review

Recommendations

1. Use safeTransferFrom from OpenZeppelin’s SafeERC20 Library

   import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

   using SafeERC20 for IERC20;

   ​

   function deposit(address token, uint256 amount) external override nonReentrant {

   if (token == address(0)) revert InvalidAddress();

   if (amount == 0) revert InvalidAmount();

   IERC20(token).safeTransferFrom(msg.sender, address(this), amount);

   _balances[token] += amount;

   _totalValue += amount;

   emit Deposited(token, amount);

   }

   ​