Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Checks-Effects-Interactions (CEI) Pattern in `Treasury::deposit` Function

auditbyte

Summary

The deposit function updates contract state (_balances and _totalValue) after transferring tokens via IERC20(token).transferFrom. This violates the Checks-Effects-Interactions (CEI) pattern. While the nonReentrant modifier from OpenZeppelin provides some protection against reentrancy, this pattern is still considered a best practice to ensure robustness and mitigate risks from edge cases or future changes.

Vulnerability Details

The vulnerability lies in the following part of the deposit function:

IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;

The function performs an external call transferFrom before updating the state _balances and _totalValue. This violates the CEI pattern, which mandates that state changes should occur before any external calls to prevent reentrancy attacks.

Impact

  1. The nonReentrant modifier significantly reduces the risk of reentrancy, but the violation of the CEI pattern introduces a potential risk if the modifier is removed or bypassed in edge cases.

  2. This could lead to inconsistent contract state and incorrect token balances.

Tools Used

Manual Code Review

Recommendations

To mitigate this vulnerability, adhere to the Checks-Effects-Interactions (CEI) pattern by updating the state before making the external call.

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
- IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
+ IERC20(token).transferFrom(msg.sender, address(this), amount);
emit Deposited(token, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.