Core Contracts

Summary:

The Treasury.sol contract deposit() function adds token amounts directly to _totalValue without any price consideration, allowing malicious users to artificially inflate the total value using worthless tokens, potentially leading to DOS conditions through arithmetic overflow.

Vulnerability Details:

In the deposit() function, the contract tracks the total value across all tokens by simply adding raw token amounts:

The issue lies in treating all token amounts as equivalent when updating _totalValue. A malicious user can:

1. Deploy a new worthless ERC20 token with a large supply

2. Deposit this token to the Treasury

3. Cause _totalValue to approach or reach uint256.max

Impact:

• DOS on legitimate deposits due to arithmetic overflow when updating _totalValue

• Incorrect total value reporting that could mislead protocol decisions

• Potential impact on any protocol mechanisms that rely on _totalValue for calculations

Tools Used:

Manual code review

Recommendations:

Several approaches could mitigate this issue:

1. Implement a whitelist of accepted tokens.

2. Implement price oracle integration to track actual USD value.