Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Attacker can DOS `deposit()` function

avci

Summary

the deposit() function in Treasury contract can be called by anyone and its first parameter is token address, means anyone can deposit any token, this can lead to DOS of this function.

Vulnerability Details

if we check deposit() function:

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}

we can see the _totalValue variable updates each time user deposits regardless of which token being deposited. this is issue because attacker can create malicious token and deposit it to the Treasury with max uint256 amount. this makes _totalValue full and unable to increase because its overflow if increases. by doing that attacker DOS the deposit() function of Treasury. also owner cannot just call withdraw() to fix that issue because attacker can make transfer() function of malicious token to always revert so this makes owner couldnt be able to withdraw() these malicious token.

function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
_balances[token] -= amount;
_totalValue -= amount;
IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}

Impact

DOS of deposit() function in Treasury contract.

Tools Used

Manual Review

Recommendations

Consider adding access control to deposit() function or remove the _totalValue or consider _totalValue specific for each tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.