Core Contracts

Summary

The Treasury::deposit function uses IERC20(token).transferFrom(...) to transfer tokens from the user to the contract. However, this method does not handle transfer failures safely for non-standard ERC-20 tokens that do not return a boolean value. Using safeTransferFrom from OpenZeppelin’s SafeERC20 library would mitigate this risk.

Vulnerability Details

The issue arises because some ERC-20 tokens (e.g., USDT) do not return a boolean value, which can cause silent failures or unexpected behavior. If the token transfer fails and the return value is not checked, the function may proceed without actually transferring the tokens.

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/collectors/Treasury.sol#L50

Impact

Deposits might not be completed as expected, leading to incorrect balances.

Tools Used

Manual code review

Recommendations

Replace the direct transferFrom call with OpenZeppelin’s SafeERC20.safeTransferFrom