Submission Details
Severity:
Malicious token can be deposit into treasury
Summary
The deposit token address is not checked,anyone malicious token can be deposit into treasury, result in treasury deposit dos due to overflow
Vulnerability Details
treasury.sol:
function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount; //@audit whitelist token not configured can lead to overflow.
emit Deposited(token, amount);
}
From above code we can see the address of deposit token is not checked.
An malicious user can depoly a malicious token , and then deposit type(uint256).max into treasury. The calculate the totalValue can be overflow result in deposit DOS
Impact
deposit DOS
Tools Used
Eye
Recommendations
add a whitelist deposit token or add access control to deposit function
Updates
Lead Judging Commences
inallhonesty about 2 months ago
Submission Judgement Published Assigned finding tags:
Treasury::deposit increments _totalValue regardless of the token, be it malicious, different decimals, FoT etc.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.