Submitted by AuditsAreUS
The function depositTokens() does not first check to ensure that the treeIndex exists.
The impact is that we will attempt to transfer from the zero address to this address. If the transfer succeeds (which it currently does not since we use IERC20.transferFrom())  then the tokenBalance of this index will be increased.
This will be an issue if the contract is updated to use OpenZeppelins safeTransferFrom() function. This update may be necessary to support non-standard ERC20 tokens such as USDT.
If the update is made then merkleTree.tokenAddress.safeTransferFrom(msg.sender, address(this), value), "ERC20 transfer failed"); will succeed if merkleTree.tokenAddress = address(0) since safeTransferFrom() succeeds against the zero address.
There are no checks the treeIndex is  valid.
Consider adding the check to ensure 0 < treeIndex <= numTrees in depositTokens().
illuzen (FactoryDAO) acknowledged, disagreed with severity and commented:
illuzen (FactoryDAO) resolved:
Justin Goro (judge) commented:
HickupHH3 (warden) commented:
Justin Goro (judge) commented:
