Summary

The Treasury.sol contract claims to support deposits of various tokens. However, it uses the transferFrom method for token transfers within the deposit() function. This approach can result in token transfer failures, particularly with tokens like USDT (Tether), which do not return a boolean success/failure response, leading to funds being stuck and improper functionality with certain tokens.

Vulnerability Details

Problem: Inadequate Handling of Token Transfers

The contract uses IERC20(token).transferFrom(msg.sender, address(this), amount); for transferring tokens. This is problematic for tokens that do not fully adhere to the ERC-20 standard, such as USDT, which doesn't return a boolean value upon transfer.

Implications of This Issue:

1. Silent Failures: Tokens like USDT may not return a true/false value on the transferFrom() call, which means the function may execute without confirming whether the transfer was successful.

2. Stuck Funds: If a transfer silently fails, the _balances mapping could be updated incorrectly, creating a discrepancy between the actual token balance and the recorded balance.

Impact

• Risk of Losing Funds: Users may think their deposit was successful when it actually failed due to silent errors in the transfer.

Tools Used

• Manual Code Review

Recommendations

1. Use safeTransferFrom from OpenZeppelin’s SafeERC20 Library

   By switching to safeTransferFrom, the contract will ensure proper validation of the transfer and automatically revert in case of failure, preventing silent errors and ensuring correct balance management.

   import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

   using SafeERC20 for IERC20;

   ​

   function deposit(address token, uint256 amount) external override nonReentrant {

   if (token == address(0)) revert InvalidAddress();

   if (amount == 0) revert InvalidAmount();

   IERC20(token).safeTransferFrom(msg.sender, address(this), amount);

   _balances[token] += amount;

   _totalValue += amount;

   emit Deposited(token, amount);

   }