A missing check in setAllowedSellToken() lets the owner waste gas by setting the same token status over and over again.

Description

• The contract allows the owner to mark any token as "allowed" for selling on the order book by toggling its status via setAllowedSellToken.

• Currently, the contract does not check whether the token is already in the desired state. As a result, repeatedly setting the same token to the same _isAllowed value leads to redundant storage writes and unnecessary event emissions.

Risk

Likelihood:

• This issue is triggered when the owner calls setAllowedSellToken() with the same value that’s already set — for example, calling setAllowedSellToken(token, true) even though the token is already allowed.

Impact:

• Each useless call wastes around 3736 gas (as confirmed in the test).

• The contract writes to storage even though the value is already the same — this is unnecessary and expensive.

• It pollutes the blockchain with extra logs.

Proof of Concept

This Proof of Concept demonstrates how the setAllowedSellToken() function allows duplicate entries for the same token, resulting in unnecessary gas usage. Here's how the PoC works:

1. A dummy token address (0x123) is created to simulate a real token.

2. The token is allowed once using setAllowedSellToken(token, true).

3. The same function is called again with the same token and the same true status.

4. Gas usage before and after the second call is measured using gasleft(), and the difference is logged.

Output

Recommended Mitigation

To avoid unnecessary gas consumption and improve function efficiency, the setAllowedSellToken() function should include a conditional check before updating the mapping.

1. Before writing to the allowedSellToken mapping, check if the new value is different from the current one.

2. It ensures that the function can only updates storage when an actual change is needed.

3. Don't forget to add TokenAlreadyAllowed()custom error in contract.