Submission Details
Severity:
getTotalValue() does not show real total value
Summary
getTotalValue() is a deceptive function because of the way the contract is written
Vulnerability Details
This function can be deceptive if anyone can deposit any token to the contract, even spammy ones
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/collectors/Treasury.sol
/**
* @notice Gets total value held by treasury
* @return Total value across all tokens
*/
function getTotalValue() external view override returns (uint256) {
return _totalValue;
}
Impact
does not show the real value the contract holds
Tools Used
manual
Recommendations
fix the logic as stated in other issues
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.