Closed howlbot-integration[bot] closed 3 months ago
This poses a security risk in case of malicious owner, since disallowedTokens can be withdrawn by owner
koolexcrypto marked the issue as duplicate of #90
koolexcrypto marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-05-loop/blob/40167e469edde09969643b6808c57e25d1b9c203/src/PrelaunchPoints.sol#L364-L366
Vulnerability details
Impact
Inability to disallow tokens when needed
Proof of Concept
The contract uses allowToken function to set the token
true
inisTokenAllowed
mapping.Accordingly, if the token to be locked is not in the mapping, it can't be locked.
However, this function is one way and there is no way to toggle the boolean to
false
For any reasons, once any token is needed to be discluded in this mapping, it won't be possible.
Tools Used
Manual Review
Recommended Mitigation Steps
Refactor the function to below;
Assessed type
Error