Fujicracy / fuji-v2

Cross-chain money market aggregator
https://fuji-v2-frontend.vercel.app
15 stars 10 forks source link

L-9 _addTokenToList is missing for XTransfer and XTransferWithCall actions #565

Open 0xdcota opened 11 months ago

0xdcota commented 11 months ago

Description

Currently, _addTokenToList is not done for both XTransfer and XTransferWithCall actions. This can result in dormant contract funds being used or unintentionally leaving funds in the contract.

Remediations to consider

While this issue is not considered severe since there are other ways of sweeping the contract, consider adding tokens to the tokensToCheck list as is done for all other actions to remove this exposure completely.