The contract lacks of a setter to disallow a token

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-05-loop/blob/40167e469edde09969643b6808c57e25d1b9c203/src/PrelaunchPoints.sol#L364-L366

Vulnerability details

Impact

Inability to disallow tokens when needed

Proof of Concept

The contract uses allowToken function to set the token true in isTokenAllowed mapping.

Contract: PrelaunchPoints.sol

364:     function allowToken(address _token) external onlyAuthorized {
365:         isTokenAllowed[_token] = true;
366:     }

Accordingly, if the token to be locked is not in the mapping, it can't be locked.

However, this function is one way and there is no way to toggle the boolean to false

For any reasons, once any token is needed to be discluded in this mapping, it won't be possible.

Tools Used

Manual Review

Recommended Mitigation Steps

Refactor the function to below;

Contract: PrelaunchPoints.sol

364:     function allowToken(address _token, bool _include) external onlyAuthorized {
-        isTokenAllowed[_token] = true;
+        isTokenAllowed[_token] = _include;
366:     }

Assessed type

Error

[0xd4n1el]

This poses a security risk in case of malicious owner, since disallowedTokens can be withdrawn by owner

[c4-judge]

koolexcrypto marked the issue as duplicate of #90

[c4-judge]

koolexcrypto marked the issue as unsatisfactory:
Invalid