Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Treasury Accounting Causes Loss Of Funds

funkornaut

Summary

The Treasury contract has critical flaws in its token handling mechanisms that can lead to permanent loss of funds and broken accounting. The issues stem from:

  1. Incorrect accounting for fee-on-transfer tokens

  2. Unsafe token transfer handling

Vulnerability Details

There are multiple related vulnerabilities in the token handling:

  1. Fee-on-transfer token accounting

  2. Unsafe Transfers

function deposit(address token, uint256 amount) external override nonReentrant {
IERC20(token).transferFrom(msg.sender, address(this), amount);
balances[token] += amount; // @audit uses input amount, not actual received amount
totalValue += amount;
}
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
balances[token] -= amount;
totalValue -= amount;
IERC20(token).transfer(recipient, amount); // @audit no success check
}

The contract:

  • It does not confirm successful transfers but updates balances. If a transfer fails or returns false the accounting will be off.

  • Uses input amounts rather than actual transferred amounts making it incompatible with fee-on transfer or rebasing tokens.

  • Cannot correct accounting discrepancies.

Impact

  1. Permanent Loss of Funds: Any tokens sent directly to the contract become permanently locked

  2. Broken Accounting: Fee-on-transfer tokens will cause the internal accounting to become incorrect

  3. Failed Transfers: Unsafe transfer handling could lead to state inconsistencies

  4. Compounding Issues: Problems compound over time as more transactions occur

Severity: HIGH - Due to permanent fund loss potential and broken core functionality

Tools Used

Manual review

Recommendations

  1. Use ERC20 `balanceOf` checks for accurate accounting on deposits and withdraws.

  2. Use SafeERC20 for all transfers.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[INVALID] SafeERC20 not used

LightChaser Low-60

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.