Arcade.xyz - auditsea's results

Lines of code

https://github.com/code-423n4/2023-07-arcade/blob/f8ac4e7c4fdea559b73d9dd5606f618d4e6c73cd/contracts/ArcadeTreasury.sol#L384-L394

Vulnerability details

Impact

A block might be blocked by expenditure limit without spending any tokens, or spend less tokens than the given limit.

Proof of Concept

In ArcadeTreasury::_approve() function, blockExpenditure of the current block will get increased when this function is called.

    function _approve(address token, address spender, uint256 amount, uint256 limit) internal {
        // check that after processing this we will not have spent more than the block limit
        uint256 spentThisBlock = blockExpenditure[block.number];
        if (amount + spentThisBlock > limit) revert T_BlockSpendLimit();
        blockExpenditure[block.number] = amount + spentThisBlock; // --> Here blockExpenditure gets increased without spending any token

        // approve tokens
        IERC20(token).approve(spender, amount);

        emit TreasuryApproval(token, spender, amount);
    }

This means, by calling only approval multiple times, the block won't be able to spend tokens, because it will be blocked by limit criteria in _spend() function.

    function _spend(address token, uint256 amount, address destination, uint256 limit) internal {
        // check that after processing this we will not have spent more than the block limit
        uint256 spentThisBlock = blockExpenditure[block.number];
        if (amount + spentThisBlock > limit) revert T_BlockSpendLimit(); // --> This line blocks spending.
        blockExpenditure[block.number] = amount + spentThisBlock;

        // transfer tokens
        if (address(token) == ETH_CONSTANT) {
            // will out-of-gas revert if recipient is a contract with logic inside receive()
            payable(destination).transfer(amount);
        } else {
            IERC20(token).safeTransfer(destination, amount);
        }

        emit TreasuryTransfer(token, destination, amount);
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Remove the line below from _approve() function

    blockExpenditure[block.number] = amount + spentThisBlock;

Assessed type

ERC20