First Flight #18: T-Swap

Summary

If token in smart contracts it is not LP token or some system generated token, then it was transfered there by unexperienced user.
It would be good to have withdraw function which can withdraw tokens not related to system by some administrator or similar user with privileges in protocol.

Vulnerability Details

Especially when starting with defi, some user can try transfer funds for creation of pool , to pool factory or similar mistake can be done in initial phase of DeFi protocol being operational.

Impact

can lost funds some unexperienced users.
lost all airdrops for those addreses (factory, tswap , pools).

Tools Used

slitehr, code review

Recommendations

Obviously it can't be that you can withdraw tokens connected and used in the pool, in pool created for those tokens, but all other tokens its good to have them somehow to withdraw. except tokens used by pool itself.
All tokens from pools factory should be also way for emergency withdraw, as there should be no tokens there.