search

sherlock-audit / 2023-12-avail-judging

4 stars 4 forks source link

kgothatso - `AvailBridge :: updateTokens` can register a non allowed tokens #79

Closed sherlock-admin closed 8 months ago

sherlock-admin commented 8 months ago

kgothatso

medium

AvailBridge :: updateTokens can register a non allowed tokens

Summary

Vulnerability Detail

Some external interactions send tokens to the account, and the token address is not checked before being registered as a collateral for the account.

Impact

loss of funds to non allowed tokens

Code Snippet

https://github.com/sherlock-audit/2023-12-avail/blob/main/contracts/src/AvailBridge.sol#L132

Tool used

Manual Review

Recommendation

Check if tokens are allowed

sherlock-admin commented 8 months ago

2 comment(s) were left on this issue during the judging contest.

tsvetanovv commented:

Admin is trusted

takarez commented:

invalid because {invalid: admin func}