Treasury accounting is false as _totalValue account for different type of token
Summary
The Treasury contract maintains a _totalValue state variable that naively adds balances of different tokens without accounting for decimals or value differences in deposit() and withdraw()
Vulnerability Details
User deposits 1 WBTC (8 decimals) = 100,000,000
User deposits 1 USDC (6 decimals) = 1,000,000
_totalValue = 101,000,000
Actually represents 1 WBTC (~$40,000) + 1 USDC ($1)
But treats them as equivalent units and equivalent value
Impact
_totalValue does not represent anything useful
Tools Used
Manual
Recommendations
Track balances separately per token
Add price oracle integration for true value aggregation
OR
remove
_totalValueand use external service like Debank to track that
Lead Judging Commences
Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.