TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

TempleGoldAdmin contract cannot transfer TempleGold tokens even if authorized to do so

jacopod

Summary

The TempleGoldAdmin contract lacks transfer functions to operate with templeGold, so it would not be able to transfer tokens even if the contract was authorized.

Vulnerability Details

The contract TempleGoldAdmin is the admin contract to operate/reconfigure the TempleGold contract.
As suche, the TempleGoldAdmin contract implements a number of functions that are an interface to the TempleGold contract such as
setStaking(), setEscrow(), setTeamGnosis(), authorizeContract(), etc.

The function templeGold.authorizeContract() enables a contract to transfer TempleGold tokens (because by default it is a non-transferrable token). The TempleGoldAdmin contract implements an equivalent function that redirects the call to the templeGold token contract:

/**
* @notice Whitelist an address to allow transfer of Temple Gold to or from
* @param _contract Contract address to whitelist
* @param _whitelist Boolean whitelist state
*/
function authorizeContract(address _contract, bool _whitelist) external override onlyElevatedAccess {
templeGold.authorizeContract(_contract, _whitelist);
}

It is reasonable to think that the templeGoldAdmin contract could be granted the authorization to handle templeGold tokens.
However, if this happens, the templeGoldAdmin contract will not be able to do so, as it does not include interfaces to transfer tokens.

Impact

The templeGoldAdmin contract will not be able to handle templeGold tokens even if authorized.
If tokens were sent there, they would become stuck lost funds.

Recommendations

Include interfaces to transfer templeGold tokens in the TempleGoldAdmin contract:

contract TempleGoldAdmin is ITempleGoldAdmin, TempleElevatedAccess {
​
// ...
​
+ function transferTempleGold(address _to, uint256 _amount) external onlyElevatedAccess {
+ templeGold.transfer(_to, _amount);
+ }
// ...
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!