Core Contracts

Summary

The _totalValue variable is intended to track the total value of assets held by the treasury. However, the contract simply increases or decreases this value whenever a deposit or withdrawal occurs, without distinguishing between different token types. Since the contract supports multiple ERC20 tokens, this approach is fundamentally flawed because it does not account for token price differences or decimals. The _totalValue could become a meaningless or misleading figure, which can result in incorrect allocations, withdrawals, or governance decisions.

Vulnerability Details

The contract updates _totalValue in the deposit and withdraw functions as follows:

• Deposit:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/collectors/Treasury.sol#L52

• Withdraw:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/collectors/Treasury.sol#L74

The _totalValue variable is meant to track the total value of assets in the treasury, but it is updated incorrectly by simply adding or subtracting token amounts without considering differences in token decimals or market value. Since the treasury supports multiple ERC20 tokens, this approach leads to a distorted _totalValue, as it treats all tokens as having the same unit of value.

For example, depositing 1 USDT (6 decimals) and 1 WETH (18 decimals) will both increase _totalValue by 1, even though their actual values differ significantly.

Additionally, withdrawals decrease _totalValue without checking if the token being withdrawn has a different decimal structure or market price. This incorrect tracking can mislead governance decisions, fund allocations, and withdrawals, potentially causing financial mismanagement.

Impact

Misreporting _totalValue could lead to severe financial mismanagement, as governance may allocate funds based on an inaccurate treasury value.

Tools Used

• Manual code review

Recommendations

To ensure _totalValue accurately represents the real value of the treasury, it should not be a simple sum of token balances. Instead, it should be calculated dynamically using an oracle-based pricing system that accounts for token prices, token decimals, and dynamic _totalValue recalculation.