Insufficient Token Validation in setAllowedSellToken Function

Description

The setAllowedSellToken function allows the owner to add or remove tokens from the allowed sell token whitelist. However, the function only performs basic validation by checking if the token address is not null and not the USDC token itself.

The function lacks comprehensive validation to ensure that the added token is a legitimate ERC20 token with safe characteristics. This could allow malicious or problematic tokens to be added to the whitelist, potentially leading to various security issues.

Risk

Likelihood:

• The owner could accidentally or maliciously add tokens with dangerous callbacks (like ERC-777 tokens) that could lead to reentrancy attacks

• The owner could add tokens with non-standard decimals or malicious transfer logic that could break the order book functionality

• The owner could add tokens with pause functionality that could be exploited to freeze user funds

Impact:

• Reentrancy attacks could drain funds from the contract if malicious tokens with callbacks are added

• Order book operations could fail or behave unexpectedly if tokens with non-standard behavior are added

• Users could lose access to their funds if pauseable tokens are added and later paused

Proof of Concept

The following example demonstrates how a malicious token with dangerous callbacks could be added to the whitelist and potentially exploited. The malicious token implements a callback mechanism in its transferFrom function that could trigger reentrancy attacks when users interact with the order book.

Recommended Mitigation

To prevent malicious tokens from being added to the whitelist, the function should implement comprehensive validation checks. The mitigation includes validating that the token is a legitimate ERC20, checking for reasonable decimals, and testing for dangerous callbacks that could lead to reentrancy attacks.