The rescueToken function in the RToken contract can never be called
Summary
The rescueToken function in the RToken contract can never be called
Vulnerability Details
The rescueToken function in the RToken contract can never be called. This function is intended to be called when tokens are mistakenly sent to the contract so they can be withdrawn and returned to the user. The function has an onlyReservePool modifier, which means that only the Reserve Pool can call this function.
Unfortunately, the Reserve Pool never calls this function, so it is inaccessible to everyone.
Impact
Mistakenly sent tokens to the contract will be stuck in the contract forever.
Tools Used
Mannual Review
Recommendations
Allow the owner to call this function.
Lead Judging Commences
RToken::rescueToken() can never be called
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.