Submission Details
Severity:
_totalValue variable can be gamed
Summary
_totalValue can be maxxed out by futile tokens since anyone can deposit to this doesnt matter the token.
Vulnerability Details
Anyone can spam this by creating futile tokens and give themselves infinite tokens only to increase _totalValue and game the system
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/collectors/Treasury.sol#L46-L55
function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}
Impact
_totalValue becomes useless after spam
Tools Used
manual
Recommendations
either limit who can deposit or what tokens can be deposited
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.