Core Contracts

Summary

The Treasury contract does not properly handle tokens that are directly sent to it (e.g. via direct transfer() calls). The contract only updates its internal balance tracking through the deposit() function, but tokens can be sent directly to the contract address, leading to a mismatch between actual and tracked balances.

When this happens, the extra tokens become permanently locked since the withdraw() function checks against the internal _balances tracking which doesn't reflect the actual token balance.

Impact

• Tokens sent directly to the Treasury contract become permanently locked

• Protocol accounting becomes inaccurate

Tools Used

Recommendations

Add a function to sync the internal balances with actual token balances.