Root + Impact

Description

• Normal behavior: The allowedSellToken mapping controls which tokens can be used to create new sell orders. The owner can enable or disable tokens at any time using setAllowedSellToken.

• Issue: If the owner sets allowedSellToken[token] = false for a token that already has active orders, users will not be able to create new orders with that token, but existing orders remain in the order book and can still be bought or canceled. This can lead to confusion, and in some cases, if the token is later re-enabled, it could be used again without additional review.

Risk

Likelihood:

• This will occur whenever the owner disables a token that already has active orders in the order book.

• Users may be confused or affected if they expect all tokens in active orders to remain tradable or withdrawable.

Impact:

• Users cannot create new orders for the disabled token, but existing orders are unaffected, which may cause confusion.

• If the token is malicious or problematic, disabling it does not remove or cancel existing orders, so some risk remains.

Proof of Concept

Users will be able to byuOrder even if token is not allowed to be sold

Recommended Mitigation

Listen to events (or iterate over existing orders which is expensive) and set active orders for disabled token as inactive.