Tadle

Summary

If a user calls functions such as listOffer, createOffer, or createTaker, which result in token transfers to capitalPoolAddr, and subsequently, the token used in these transactions is removed from the whitelist by an admin, the settleAskMaker and settleAskTaker functions will revert. This occurs because the tokens used in these transactions will no longer be recognized as valid by the tillIn function, which requires whitelisted tokens.

Vulnerability Details

The settleAskMaker function, which processes settlements for offers made by sellers (makers), and the settleAskTaker function, which handles settlements for offers accepted by buyers (takers), both rely on the tillIn function to validate the whitelisted status of tokens before proceeding. The relevant code snippet for settleAskMaker is:

The tillIn function, as provided earlier, checks whether the token being deposited is whitelisted. If the token is not in the whitelist, the function reverts:

When the token is removed from the whitelist, the subsequent calls to settleAskMaker or settleAskTaker, which involve the token, will fail because the tillIn function will revert upon detecting that the token is no longer whitelisted.

Impact

If the token used in previous transactions is removed from the whitelist, the settleAskMaker and settleAskTaker functions will revert, preventing successful settlement of offers. This results in potential transaction failures and loss of funds or points, as the contracts will be unable to complete the settlement process.

Tools Used

Manual

Recommendations

To mitigate this issue, ensure that token whitelisting changes are managed carefully and consider implementing mechanisms to handle or transition tokens that are removed from the whitelist. One approach could be:

• to implement a grace period or a separate function that handles token transitions to avoid disrupting ongoing transactions.

• Additionally, consider adding checks or notifications to alert users of whitelist changes that might affect their transactions.