Submission Details
Severity:
In `Treasury` the token transfers are handled without `safeTransfer` and `safeTransferFrom`
Summary
Some ERC-20 tokens will return on failure instead of reverting a transaction, Some tokens will even not return any value. Not all tokens adhere to the ERC-20 standard
Vulnerability Details
In Treasury::deposit and Treasury::withdraw token transfers are handled using transfer and transferFrom
function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
// @audit-issue
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}
Impact
Tools Used
Recommendations
Use safeTrasnfer and safeTransferFrom
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.