a call to `TokenManager::updateTokenWhiteListed` can brick the offers (that have a status other than `Online`) of the marketplaces that had their tokenAddress "unwhitelisted".
Relevant Links
Summary
DeliveryPlace::settleAskTaker and DeliveryPlace::settleAskMaker all call TokenManager::tillIn providing the tokenAddress of the appropriate marketplace.
The method TokenManager::updateTokenWhiteListed which can be used to "unwhitelist" ( in other words disable) a token to be used in the app does not take into account that there might exist offers ( that belong to a marketplace whose token has just been disabled) that are perhaps in the AskSettling or BidSettling stage that might perhaps have already been partially "asked" on by caling DeliveryPlace::settleAskMaker or DeliveryPlace:SettleAskTaker. I should not that, we can not update the tokenAddress of a marketplace.
Vulnerability Details
Offers whose token address have been unwhitelisted can no longer be settled completely. even if it was partially settled before the unwhitelisting.
Impact
Offers are created that can not be completely settled.
Tools Used
Manual review
Recommendations
update the
TokenManager::updateTokenWhiteListedmethod to include the following:
If we wish to disabletokenA, we should provide another whitelisted tokentokenBwith which we'll update all the market places that had their token address previously set totokenA(MarketPlaceInfo.tokenAddress == tokenA)Or prevent disabling a token if there are partially settled offers for this token
Lead Judging Commences
[invalid] finding-Admin-Errors-Malicious
The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.