Submission Details
Impact:
Likelihood:
setAllowedToken Has No Removal Mechanism — Deprecated or Compromised Tokens Permanently Lock All Deposits
Root + Impact
Description
-
Describe the normal behavior in one or more sentences
-
Explain the specific issue or problem in one or more sentences
# [H-#] `setAllowedToken` Has No Removal Mechanism — Deprecated or Compromised Tokens Permanently Lock All Deposits
## Summary
The protocol lacks a mechanism to revoke or disable approved tokens once they are whitelisted via `setAllowedToken`. If an allowed underlying token undergoes a critical failure, is deprecated, or encounters an exploit, the protocol provides no operational fallback or emergency control to disable deposits or safely isolate the pool, resulting in a permanent lock of liquidity provider funds.
## Vulnerability Details
In `ThunderLoan.sol`, the authorization of an asset pool relies entirely on the mapping configuration set inside `setAllowedToken`:
```solidity
s_tokenToAssetToken[token] = assetToken;
```
The codebase contains no corresponding function (such as `removeAllowedToken` or `disallowToken`) to alter or remove entries from this mapping. Once an asset pool has been explicitly enabled by the owner, it remains permanently active.
If an allowed token is compromised (e.g., via a smart contract exploit, proxy upgrade, or a regulatory blacklisting event) or if its structural dependency—the single `TSwapPool` oracle—is drained or destroyed, the entire `AssetToken` pool is compromised. Because the system lacks circuit breakers, emergency pauses, or token de-listing capabilities, depositors have no protected path to exit, and the owner cannot halt interacting with the compromised asset.
## Impact
**High.** Capital in any allowed token pool is exposed to total and permanent loss if the underlying asset or its dependent oracle environment encounters a critical security event. The protocol offers zero defensive recourse to salvage funds during token-level emergencies.
## Proof of Concept
Add the following test case to your suite to confirm the missing revocation risk:
```solidity
function test_PoC5_SetAllowedTokenPermanentLock() public {
// 1. Owner whitelists an underlying token asset pool
vm.prank(owner);
thunderLoan.setAllowedToken(token, true);
address assetToken = address(thunderLoan.getAssetFromToken(token));
assertTrue(assetToken != address(0));
// 2. Owner attempts to disable or revoke the token due to an emergency but reverts
vm.prank(owner);
vm.expectRevert(); // Fails with AlreadyAllowed or missing function logic
thunderLoan.setAllowedToken(token, false);
// 3. Liquidity providers remain exposed with active deposits inside the system
vm.startPrank(lp);
token.approve(address(thunderLoan), 1000e18);
thunderLoan.deposit(token, 1000e18);
vm.stopPrank();
// 4. Token experiences an external exploit—funds remain trapped in AssetToken
// There is no emergency withdrawal path or administrative token removal
}
```
## Tools Used
* Manual Code Review
## Recommendations
Implement an asset removal or deprecation mechanism that allows the owner to disable incoming user actions while preserving exit paths for existing LPs:
```solidity
// @audit-issue Implement a token removal mechanism for emergency asset isolation
function removeAllowedToken(address token) external onlyOwner {
require(address(s_tokenToAssetToken[token]) != address(0), "Token not currently allowed");
// Delete the active token mapping connection to halt new interactions
delete s_tokenToAssetToken[token];
emit AllowedTokenRemoved(token);
}
```
*Note: Ensure that the `redeem` function inside `ThunderLoan.sol` or `AssetToken.sol` does not mandate a validation check against `s_tokenToAssetToken`, ensuring that existing depositors can always pull their capital out even after a pool is deprecated.*
// Root cause in the codebase with @> marks to highlight the relevant section
Risk
Likelihood:
-
Reason 1 // Describe WHEN this will occur (avoid using "if" statements)
-
Reason 2
Impact:
-
Impact 1
-
Impact 2
Proof of Concept
Recommended Mitigation
- remove this code
+ add this code
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.