The administrator may not be able to remove tokens from the omnipool due to restrictions in omnipool#remove_token
Proof of Concept
In remove_token, we need to make sure that asset_state.shares == asset_state.protocol_shares,
This restriction is to ensure that asset no shares owned by LPs.
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/omnipool/src/lib.rs#L1548
Vulnerability details
Impact
The administrator may not be able to remove tokens from the omnipool due to restrictions in omnipool#remove_token
Proof of Concept
In remove_token, we need to make sure that asset_state.shares == asset_state.protocol_shares, This restriction is to ensure that asset no shares owned by LPs.
The problem is that this condition may never be met, There are two reasons:
Tools Used
vscode, manual
Recommended Mitigation Steps
Use another way to determine whether the LPs owns the asset shares
Assessed type
Other