Submission Details
Severity:
getTotalValue() does not show real total value
Summary
getTotalValue() is a deceptive function because of the way the contract is written
Vulnerability Details
This function can be deceptive if anyone can deposit any token to the contract, even spammy ones
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/collectors/Treasury.sol
/**
* @notice Gets total value held by treasury
* @return Total value across all tokens
*/
function getTotalValue() external view override returns (uint256) {
return _totalValue;
}
Impact
does not show the real value the contract holds
Tools Used
manual
Recommendations
fix the logic as stated in other issues
Updates
Lead Judging Commences
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.