# Null transfers in `IDOPoolAbstract::_depositToTreasury()` could be skipped Low/Info · Three Sigma · IDO launchpad · 7th August, 2024 Finding I-1 of the Blast IDO Pools security review. - Protocol: https://docs.blastup.io/blastup-docs - Report: /reports/blast-ido-pools - Source: https://cdn.sanity.io/files/qoqld077/production/d2a7ca81740e715b604122c12dafbce599e43f2f.pdf --- ### Description `IDOPoolAbstract::_depositToTreasury()` transfers `pos.fyAmount` and `pos.amount - pos.fyAmount`, but one of them may be `0` if the account only used `buyTokens` or `fyTokens`. Thus, if one of these 2 amounts is null, the transfer can be skipped. This can be relevant depending on the token used, as some revert on null transfers. ### Recommendation ```solidity function _depositToTreasury(uint32 idoRoundId, IDOStructs.Position memory pos) internal { IDOStructs.IDORoundConfig storage ido = idoRoundConfigs[idoRoundId]; if (pos.fyAmount > 0) TokenTransfer._transferToken(ido.fyToken, treasury, pos.fyAmount); if (pos.amount - pos.fyAmount > 0) TokenTransfer._transferToken(ido.buyToken, treasury, pos.amount - pos.fyAmount); } ``` --- Related findings: - [`Treasury.noOfBorrowers` can be set to 0 by looping wei deposit<->withdrawals and DoS withdrawals and reset borrower debt](https://0xsimao.com/findings/autonomint-wei-deposit-withdrawals-debt): Autonomint - [Borrower deposit, withdraw, deposit will reinit `omniChainData.cdsPoolValue`, getting profit stuck for cds depositors](https://0xsimao.com/findings/autonomint-deposit-withdraw-reinit-stuck): Autonomint - [AaveYieldBackend.deposit() DoS when Aave pool is paused, frozen, or at supply cap](https://0xsimao.com/findings/superfluid-aave-yield-deposit-paused): Superfluid Yield Backends