Core Contracts

Summary
Potential token transfer issue in Treasury contract's withdraw() function using .transfer()

Vulnerability Details

The withdraw function in Treasury.sol uses .transfer() method with fixed 2300 gas

• Lacks SafeERC20 transfer mechanism

  However, using .transfer() enforces a 2300 gas which will not work for addresses that consume a large amount of gas upon receiving tokens.

  
  ```solidity

  function withdraw(

  address token,

  uint256 amount,

  address recipient

  ) external override nonReentrant onlyRole(MANAGER_ROLE) {

  if (token == address(0)) revert InvalidAddress();

  if (recipient == address(0)) revert InvalidRecipient();

  if (_balances[token] < amount) revert InsufficientBalance();

  _balances[token] -= amount;

  _totalValue -= amount;

  IERC20(token).transfer(recipient, amount);

  emit Withdrawn(token, amount, recipient);

  }

  
  ```

Impact
Low/Med risk: Possible token transfer interruptions

• Transactions if failed, may cause a lock of funds or unexpectedly revert.

• Compromises fund withdrawal reliability

Tools Used
Manual code review

Recommendations
Replace .transfer() with safeTransfer()

• Import and use OpenZeppelin's SafeERC20 library for safer implementation