Core Contracts

Summary

The lack of token address validation in the deposit function is a medium severity issue that can lead to potential function failures, security vulnerabilities, and financial losses. Implementing validation to ensure that the token address provided is an ERC20 token address is essential to address this issue and enhance the security and reliability of the contract. Conducting a thorough audit and testing of the contract is also recommended to ensure the validation logic is correctly implemented and secure.

Vulnerability Details

The deposit function in the Treasury contract does not validate that the token address provided is an ERC20 token address. This can allow a malicious user to call the function with a non-ERC20 token address, causing the function to fail or behave unexpectedly. This lack of validation can compromise the integrity of the contract, leading to potential security vulnerabilities and financial losses.

Impact

• Function Failure: The function may fail or behave unexpectedly if called with a non-ERC20 token address.

• Security Vulnerability: The lack of validation can be exploited by malicious users, leading to potential security vulnerabilities.

• Financial Loss: Users may lose funds if the function fails or behaves unexpectedly due to an invalid token address.

Tools Used

Recommendations

1. Token Address Validation: Implement validation to ensure that the token address provided is an ERC20 token address. This can be done by checking if the address implements the ERC20 interface.

2. Audit and Testing: Conduct a thorough audit and testing of the contract to ensure that the validation logic is correctly implemented and secure.

   function deposit(address tokenAddress, uint256 amount) external {

   require(amount > 0, "Amount must be greater than zero");

   require(isERC20(tokenAddress), "Invalid token address");

   ​

   IERC20 token = IERC20(tokenAddress);

   deposits[msg.sender][tokenAddress] += amount;

   // Transfer the tokens from the user to the contract

   require(token.transferFrom(msg.sender, address(this), amount), "Transfer failed");

   emit Deposit(msg.sender, tokenAddress, amount);

   }