Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of whitelisted token removal function can cause protocol issues

abarbatei

Lack of whitelisted token removal function can cause protocol issues

Summary

ProxyFactory sets the whitelisted token list in its constructor and does not allow any further changes to this.
This presents an issue if any token ever is needed to be removed or any token was wrongly added to the factory.

Vulnerability Details

There are known cases where top tokens can fall and die, example LUNA. Also, recent black swan events even lead to a slight depeg in USDC with no guarantee that no future black swan may not severely depege it.

Further, there is the possibility that deployer mistakenly added the wrong token value, which is actually the case in the current project if we examine deployment scripts:

DeployContracts. gets the whitelisted tokens from the HelperConfig helper

HelperConfig config = new HelperConfig();
// get the addresses of the tokens to whitelist
(address jpycv1Address, address jpycv2Address, address usdcAddress,, uint256 deployerKey) =
config.activeNetworkConfig();
// whitelist 3 kinds of tokens
address[] memory tokensToWhitelist = new address[](3);
tokensToWhitelist[0] = jpycv1Address;
tokensToWhitelist[1] = jpycv2Address;
tokensToWhitelist[2] = usdcAddress;

which, for Polygon, where sponsor confirmed (in discord) that the project will most likely be deployed, has an invalid address:

function getPolygonConfig() public view returns (NetworkConfig memory) {
// real addresses
address[] memory arr = new address[](3);
arr[0] = 0x431D5dfF03120AFA4bDf332c61A6e1766eF37BDB; // jpyc v2 on polygon
arr[1] = 0x2370f9d504c7a6E775bf6E14B3F12846b594cD53; // jpyc v1 on polygon
arr[2] = 0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174; // usdc on polygon
// arr[3] = 0xc2132D05D31c914a87C6611C10748AEb04B58e8F; // usdt on polygon

the address for jpyc v1 on polygon is set to 0x2370f9d504c7a6E775bf6E14B3F12846b594cD53 which is an EOA on Polygon. JPY Coin (JPYC) V1 address on Ethereum, 0x2370f9d504c7a6E775bf6E14B3F12846b594cD53 is the actual contract.

Deployment scripts are OOS, the above elaboration was to show that not only deployment mistake can happen, with current configuration it will happen and protocol should be make resilient to such issues.

Impact

Malicious, old, wrongly added or dead whitelisted tokens will cause protocol to potentially misbehave.

Tools Used

Manual review.

Recommendations

Allow the setting of whitelisted tokens, via a setter, by the contract owner.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.