Summary

If the owner creates a new token with the same symbol as previously created token then it will replace the existing token address in the mapping s_tokenToAddress.

Vulnerability Details

The function TokenFactory::deployToken don't check if there is an already deployed token contract corresponding to symbol, which will thus lead to replacing the address of the contract if the function is called again with the same symbol.

Impact

Owner can mistakenly pass the pre-existin token contract's symbol which will replace the address.

Tools Used

Manual Review

Recommendations

• To have a check in the TokenFactory::deployToken function to revert if the address corresponding to a symbol is not address(0) then it should revert.

• Also if the protocol wants to change the contract corresponding to a symbol, then a new function modifyToken can be implemented which will deploy a new token contract and change the address to the address of newly deployed token contract.