Summary

The setAllowedSellToken function allows the contract owner to blacklist any sell token at any time. While this does not freeze user funds (since users can always cancel their orders and withdraw tokens), it does prevent new orders from being created with the blacklisted token, disrupting user experience and market activity for that asset.

Vulnerability Details

lets the owner set any token as not allowed (_isAllowed = false). After blacklisting, users cannot create new sell orders for that token. However, users with existing orders can still cancel and withdraw their tokens, so funds are not permanently frozen.

Impact

• Users cannot create new orders for a blacklisted token.

• Existing orders for blacklisted tokens can still be cancelled, allowing users to withdraw their tokens.

• No permanent loss or freezing of user funds, but trading for the blacklisted token is disrupted.

Proof of Concept (PoC)

1. User creates a sell order for token X (e.g., wETH).

2. Owner calls setAllowedSellToken(tokenX, false).

3. User tries to create a new order for token X: transaction reverts.

4. User with an existing order for token X can still call cancelSellOrder and withdraw their tokens.

Recommended Mitigation

• Consider implementing a time delay or grace period before a token is blacklisted, allowing users to react.

• Notify users of upcoming blacklists via events or off-chain services.

• Consider using a decentralized governance process for blacklisting tokens, rather than a single owner.