Core Contracts

Summary

The Treasury.sol contract documentation states that it supports multi-token deposits. Given this claim, the contract is expected to work seamlessly with various ERC-20 tokens. However, an issue has been identified:

• The _totalValue variable is updated incorrectly without considering token decimals, leading to inaccurate treasury value calculations.

Vulnerability Details

Issue: Incorrect _totalValue Calculation Due to Token Decimal Differences

The contract updates _totalValue as _totalValue += amount;, but it does so without considering that different tokens have different decimals. For example:

• USDC and USDT use 6 decimals (1 USDC = 1 * 10^6 in raw units).

• DAI and ETH-based tokens use 18 decimals (1 DAI = 1 * 10^18).

• Summing these raw values directly leads to inaccurate treasury value calculations.

Problems Caused by This Issue:

1. Misleading Treasury Value: The contract may overestimate or underestimate its total value, leading to incorrect financial decision-making.

Impact

• Incorrect Treasury Valuation: Governance or fund allocation decisions could be made based on incorrect data, affecting protocol sustainability.

• Risk of Incorrect Balance Accounting: The contract might reflect a deposit that never actually occurred, leading to misreported treasury holdings.

Tools Used

• Manual Code Review

Recommendations

1. Normalize _totalValue Based on Token Decimals

   • Introduce a mapping decimals to store the decimal count of each token.

   • Convert all values to a standard 18-decimal format before updating _totalValue.

   Example fix:

   function deposit(address token, uint256 amount) external override nonReentrant {

   if (token == address(0)) revert InvalidAddress();

   if (amount == 0) revert InvalidAmount();

   IERC20(token).safeTransferFrom(msg.sender, address(this), amount);

   _balances[token] += amount;

   uint256 normalizedAmount = amount * (10**(18 - tokenDecimals[token]));

   _totalValue += normalizedAmount;

   emit Deposited(token, amount);

   }

   ​