search

code-423n4 / 2022-01-livepeer-findings

0 stars 0 forks source link

Migrate old balance on setToken #234

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

pauliax

Vulnerability details

Impact

In contract BridgeMinter function setToken, it just sets the new tokenAddr, but it does not process the old token balance leaving it stuck in the contract. I think that setToken could also migrate the old balance somewhere before updating the token address. I can even suggest adding token rescue functions to the contracts that may come in handy in such cases or if someone accidentally sends the tokens directly to the contract. An owner can rescue the tokens if the token is not protected (e.g. intended to be held in the contract).

Recommended Mitigation Steps

An example implementation that could help to rescue old token balance:

  function withdrawLPTToL1Migrator(address _tokenAddr, address _recipient) external onlyControllerOwner returns (uint256) {
      require(_tokenAddr != tokenAddr, "protected");

      IERC20 token = IERC20(_tokenAddr);

      uint256 balance = token.balanceOf(address(this));

      token.transfer(_recipient, balance);

      return balance;
  }
yondonfu commented 2 years ago

Fixed in https://github.com/livepeer/protocol/pull/530