Sparkn

Summary

The whitelistedTokens array cannot be modified after deployment. Thus new tokens cannot be added, and more importantly, older tokens cannot be removed. This can be an issue if a token gets hacked or is found to be vulnerable, and the owner wants to remove it from the whitelist.

Vulnerability Details

The whitelistedTokens array is initialized in the constructor. It is never modified elsewhere in the contract. Thus even the owners cannot modify it after deployment.

The issue with this approach is that new tokens which are deemed safe and enter mainstream usage cannot be added. Also, older tokens which have been found to be vulnerable cannot be removed. This limits the usability of the contract in the future.

Impact

Whitelisted tokens cannot be extended / modified after deployment.

Tools Used

Manual Review

Recommendations

Make the whitelistedTokens array modifiable by the owner.