stake.link

Summary

Token sweeping functions can inadvertently disrupt accurate accounting in systems where tokens are associated with multiple addresses, particularly in cases where one address's actions affect another's balance.

Vulnerability Details

In the past, there have been incidents where a token unintentionally had two addresses with control over its balance.

Transfers made using one address affected the balance of the other.

Impact

Loss of funds, incorrect token distribution, and a general lack of trust.

Tools Used

Manual review

Recommendations

To guard against this scenario, sweep functions should verify that the balance of the non-sweepable token remains unchanged after transferring the swept tokens.