Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

The protocol has no functionality to remove whitelisted tokens if necessary

tsvetanovv

Summary

The protocol has no functionality to remove whitelisted tokens if necessary. It is possible that the price of a token drops a lot or for some other reason it is not good to be in the whitelisted array of tokens, but already added there it can not be removed.

Vulnerability Details

In ProxyFactory.sol the constructor will set the whitelist tokens:

constructor(address[] memory _whitelistedTokens) EIP712("ProxyFactory", "1") Ownable() {
if (_whitelistedTokens.length == 0) revert ProxyFactory__NoEmptyArray();
for (uint256 i; i < _whitelistedTokens.length;) {
if (_whitelistedTokens[i] == address(0)) revert ProxyFactory__NoZeroAddress();
whitelistedTokens[_whitelistedTokens[i]] = true;
unchecked {
i++;
}
}
}

But once added there is no way to remove them. This is dangerous and there should be functionality to react to if a token needs to be removed from the whitelist.

Impact

No functionality to remove whitelisted tokens if necessary. If there is an unwanted token added there is no way to remove it and this makes the list of white tokens somewhat less effective.

Tools Used

Visual Studio Code

Recommendations

Add an admin control function to remove tokens from the whitelist if necessary.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.