Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Treasury fails to provide multi-token support

dentonylifer

Summary

Treasury fails to provide multi-token support due to outdated token transfer method.

Vulnerability Details

Link

Per docs, treasury should provide multi-token support:

Purpose
Securely manage protocol funds with multi-token support

Notes
The contract supports multiple ERC20 tokens

However, in deposit() function outdated token transfer method is used - transferFrom() instead of safeTransferFrom():

IERC20(token).transferFrom(msg.sender, address(this), amount);

For example, if no-revert-on-failure tokens are used (e.g. ZRX, EURS), deposit will be successful and state variables will be updated, even if transferFrom() was unsuccessful and 0 tokens was sent to treasury.
Or FoT tokens (e.g. STA, PAXG) can be used - state variables will show incorrect values.
Also some tokens that returns void instead of bool (e.g. USDT, BNB, OMG) cannot be used.

Impact

Treasury fails to provide multi-token support due to outdated token transfer method.

Tools Used

Manual review.

Recommendations

- IERC20(token).transferFrom(msg.sender, address(this), amount);
+ IERC20(token).safeTransferFrom(msg.sender, address(this), amount);
- IERC20(token).transfer(recipient, amount);
+ IERC20(token).safeTransfer(recipient, amount);
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!