Sparkn

Summary

No protection against tokens like USDC which are upgradeable, whose implementation behind their proxy can change in future.

Vulnerability Details

Some tokens (e.g. USDC) are upgradable, allowing the token owners to make modifications to the logic of the token at any point in time.


A change to the token semantics can break any smart contract that depends on the past behaviour.


Developers integrating with upgradable tokens should consider introducing logic that will freeze interactions with the token in question if an upgrade is detected. (e.g. the TUSD adapter used by MakerDAO).

Impact

Possibility of protocol breaking.

Tools Used

Manual review

Recommendations

Consider implementing a logic which detects if token's implementation has changed. If yes, re-whitelisting should be required. MakerDAO example: TUSD adapter