Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of Token Support Validation in Transfer Operations

dreamcoder

Summary

In Treasury.sol file

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}

The contract assumes all tokens behave like standard ERC-20, but some tokens have fee-on-transfer mechanisms or non-standard return values (e.g., USDT, BNB, etc.).

So if IERC20(token).transferFrom fails, it will not revert and return false.

But the function didn't check the return value.

As result, the contract didn't receive token and increase _balances[token].

Vulnerability Details

The function withdraw() uses the standard IERC20.transferFrom() method.
Some ERC-20 tokens (e.g., USDT) return false on failure instead of reverting.
The contract does not validate the return value of transfer().
If transferFrom() fails silently, the contract may assume the transfer succeeded and increase _balances.

Impact

Even though the sender's transferfrom fails, _balances and _totalValue is increased, it will be different with real balance.

SO contract will occur unexpected behavior.

Tools Used

manual

Recommendations

Use OpenZeppelin’s SafeERC20.safeTransfer() to ensure compatibility with all ERC-20 tokens, including those that return false instead of reverting.

+++ import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+++ using SafeERC20 for IERC20;
​
function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
​
--- IERC20(token).transferFrom(msg.sender, address(this), amount);
+++ IERC20(token).safeTransferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[INVALID] SafeERC20 not used

LightChaser Low-60

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.