Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Treasury doesn't account for fee on transfer or rebase tokens

copperscrewer

Summary

Treasury expects the amount in the transfer function will have the same amount received or withdrawn, however this is not true for fee-on-transfer tokens or rebase tokens.

Vulnerability Details

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
@> IERC20(token).transferFrom(msg.sender, address(this), amount);
@> _balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
@> _balances[token] -= amount;
_totalValue -= amount;
@> IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}

The deposit and Withdraw don't check for the amount of tokens received and increment the balance of the particular token.

They rely on the value passed to the transfer ~ functions and increment the balance.

This will lead to disparity of balances where the reserves has lesser token amount than what the balance mapping shows.

Impact

Users may not be able to redeem their amount because of incorrectly

Tools Used

Manual analysis

Recommendations

check for balance that was given and taken away and adjust balance mapping accordingly.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::deposit increments _balances[token] with amount, not taking FoT or rebasing into account

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.