Summary

When the function dewhitelistToken is called it deletes the following data:

The attribute selector is used to check whether the token is not whitelisted LibTokenSilo:

LibTokenSilo.beanDenonimatedValue:

This logic makes sense as any token that is not in the whitelist doesn't have a selector either because the token hasn't been added or because it went through the dewhitelist function.

But the function updateStalkPerBdvPerSeasonForToken from LibWhitelist utilizes the milestoneSeason attribute which is never deleted since the moment that a token is added to the whitelist.

It means that a token that was passed on dewhitelistToken will still be considered a whitelisted token and his attributes will be updated such as:

Impact

A token that is not whitelisted can bypass this function and disrupt the protocol's logic.

Tools Used

Manual Review

Recommendations

Check for the selector instead of milestoneSeason to ensure the token is not whitelisted.