Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Inaccurate `_totalValue` tracking in `Treasury.sol` due to neglecting token value differences.

mo_

Summary

Inaccurate _totalValue tracking in Treasury.sol due to neglecting token value differences.

Vulnerability Details

The _totalValue state variable in Treasury.sol is updated by simply adding or subtracting token amounts during deposits and withdrawals. This approach fails to account for the varying values of different tokens held in the treasury. Consequently, _totalValue becomes an inaccurate representation of the actual treasury value.

Code Snippet:

​
// contracts/core/collectors/Treasury.sol
​
function deposit(address token, uint256 amount) external override nonReentrant {
// ...
_totalValue += amount; // Naive increment, ignores token value
// ...
}
​
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
// ...
_totalValue -= amount; // Naive decrement, ignores token value
// ...
}

_totalValue is updated with raw token amounts, disregarding the potentially different and fluctuating values of each token.

Impact

  • Misleading getTotalValue(): The function returns an inaccurate total value of treasury assets.

  • Lack of Real Value Metric: _totalValue becomes a meaningless metric for assessing the treasury's financial status.

Tools Used

Manual code review.

Recommendations

Implement a value-aware _totalValue update mechanism. Consider:

  1. Value Tracking per Token: Maintain a mapping of token to value and update _totalValue based on these tracked values during deposits and withdrawals.

  2. Remove _totalValue: If accurate total value tracking is not critical, consider removing _totalValue to avoid providing a misleading metric.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.