Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Whitelisted tokens can not be updated later.

shanb1605

Summary

All token whitelisting is done through the ProxyFactory constructor. The ProxyFactory contract doesn't have any update functionality to update further whitelisted tokens.

Vulnerability Details

The natspec of the Distributor contract states that General ERC20 stablecoin tokens, e.g. JPYC, USDC, USDT, DAI, etc, are supposed to be used in SPARKN

When Deploying the ProxyFactory contract with only JPYC,USDC but if there is any concern to add or remove a new token it's impossible to do that. Because the whitelist is already set in construct and there is no update functionality.

Impact

It will be hard to upgrade the ProxyFactory contract for any add or removal of tokens each time.

Tools Used

Manual Review

Recommendations

Add update whitelist token by Owner function to the contract:

//Add or Remove Tokens through the boolean flag
function updateWhitelistedToken(address token, bool flag) public onlyOwner {
whitelistedTokens[token] = flag;
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.