Submission Details
Severity:
Add Remove Allowed Token Funtion
Summary
Admin should have ability to remove Allowed Token Funtion
Vulnerability Details
isAllowedToken modifier checks against a list of allowed tokens, then it's still possible that a token in this list has been compromised/is malicious/price fee error. To mitigate this, the contract owner should have the ability to remove tokens from the list.
Impact
An attacker could potentially use a malicious token contract to exploit the contract.
Tools Used
manually reviewed
Recommendations
Provide a function that would allow the contract owner to remove a token from the allowed list
import "@openzeppelin/contracts/access/Ownable.sol";
contract DSCEngine is ReentrancyGuard, Ownable {
event TokenRemoved(address indexed token);
// function to remove a token from the allowed list
function removeToken(address token) public onlyOwner isAllowedToken(token) {
delete s_priceFeeds[token];
emit TokenRemoved(token);
}
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.