Core Contracts

Summary

The lack of state tracking and validation in the withdraw function is a high severity issue that can lead to potential misuse of funds, discrepancies, and security vulnerabilities. Implementing proper state tracking, additional recipient validation, and using safe transfer methods are essential to address this issue and enhance the security and reliability of the contract. Conducting a thorough audit and testing of the contract is also recommended to ensure the logic is correctly implemented and secure.

Vulnerability Details

The withdraw function in the Treasury contract does not track the withdrawn amount for the recipient, leading to potential discrepancies and misuse. The function also does not validate the recipient address beyond checking if it is not a zero address, which can result in funds being sent to unintended or malicious addresses. Additionally, the function uses IERC20(token).transfer(recipient, amount) instead of transferFrom or safeTransferFrom, which can lead to issues if the token contract does not implement the standard transfer function correctly or if there are additional checks needed.

Impact

• Loss of Funds: Users may lose their funds if the withdrawn amounts are not tracked correctly or if funds are sent to unintended or malicious addresses.

• Discrepancies: Lack of state tracking can lead to discrepancies in the contract's records, making it difficult to audit and verify transactions.

• Security Vulnerability: The use of transfer instead of transferFrom or safeTransferFrom can lead to potential security vulnerabilities if the token contract does not implement the standard transfer function correctly.

Tools Used

Manual review

Recommendations

1. State Tracking: Implement state tracking to record the withdrawn amounts for each recipient. This can be done using a mapping to store the withdrawn amounts for each user and token.

2. Recipient Validation: Implement additional validation to ensure that the recipient address is valid and intended.

3. Use of Safe Transfer: Use safeTransferFrom from OpenZeppelin's SafeERC20 library to ensure that the transfer is performed safely and correctly.