Submission Details
Severity:
There is no mechanism to update whitelistedTokens once the contract is set up
Summary
Once the ProxyFactory contract is set up, there is no mechanism for owners to update/add/remove the whitelistedTokens which could be a potential issue in the future.
Vulnerability Details
https://github.com/Cyfrin/2023-08-sparkn/blob/main/src/ProxyFactory.sol#L84C5-L85
constructor(address[] memory _whitelistedTokens) EIP712("ProxyFactory", "1") Ownable() {
if (_whitelistedTokens.length == 0) revert ProxyFactory__NoEmptyArray();
for (uint256 i; i < _whitelistedTokens.length;) {
if (_whitelistedTokens[i] == address(0)) revert ProxyFactory__NoZeroAddress();
whitelistedTokens[_whitelistedTokens[i]] = true;
unchecked {
i++;
}
}
}
Tools Used
Manual review
Recommendations
Add some functions to update the whitelistedTokens
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.