Closed howlbot-integration[bot] closed 3 months ago
This poses a security risk in case of malicious owner, since disallowedTokens can be withdrawn by owner
koolexcrypto marked the issue as duplicate of #90
koolexcrypto marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-05-loop/blob/40167e469edde09969643b6808c57e25d1b9c203/src/PrelaunchPoints.sol#L364-L366
Vulnerability details
Impact
There is no way to avoid harm from allowed token which been proved exploitable.
Proof of Concept
Owner of PrelaunchPoints have authority to add allowed token, but can't remove it if one of allowed tokens have been proved exploitable, this could harm the protocol.
Tools Used
Vscode
Recommended Mitigation Steps
Add a bool parameter to add/remove allowed token
Assessed type
Access Control