Closed howlbot-integration[bot] closed 3 months ago
This poses a critical risk for users in case of a malicious owner, since it can withdraw disallowed tokens
koolexcrypto marked the issue as primary issue
koolexcrypto marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-05-loop/blob/40167e469edde09969643b6808c57e25d1b9c203/src/PrelaunchPoints.sol#L364-L366
Vulnerability details
Impact
The
isTokenAllowed
map contains a whitelist of tokens permitted by the project team for users to lock, and tokens can be added to this whitelist through theallowToken
function. However, theallowToken
function can only add a specified token to the whitelist by settingisTokenAllowed[_token]
totrue
; it does not have the capability to remove tokens from the whitelist by settingisTokenAllowed[_token]
tofalse
.This could result in a scenario where if a token on the whitelist is found to have vulnerabilities, the
PrelaunchPoints
contract would not be able to remove that token from the whitelist. Consequently, users could still lock the vulnerable token in the contract, potentially exposing thePrelaunchPoints
contract to attack, which in severe cases could lead to asset loss.Tools Used
None
Recommended Mitigation Steps
To address the issue, the allowToken function could be modified as follows:
Assessed type
Other