F-2024-0005·silent-failure

Silent failure in add_account_to_whitelist method

Acknowledgedbridgenearrainbow-bridgegithub.com/Near-One/rainbow-token-connector
TL;DR

add_account_to_whitelist does not check the return value of insert; callers are not informed whether the account was newly added or already present.

Severity
LOW
Impact
LOW
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The add_account_to_whitelist method in the provided code has a silent failure vulnerability. The method attempts to add an account to the whitelist using the insert function, but it does not handle the case when the account already exists in the whitelist.

When the insert function is called with a key that already exists in the map, it returns false. However, the add_account_to_whitelist method does not check the return value of insert and does not provide any feedback or error handling mechanism to indicate that the account was not added to the whitelist due to its presence.

03Section · Impact

Impact

The caller of the method is not informed whether the account was successfully added to the whitelist or if it already existed.

04Section · Recommendation

Recommendation

If the account already exists in the whitelist, panic with a meaningful error message indicating that the account is already whitelisted.

Example:

rust
pub fn add_account_to_whitelist(&mut self, token: AccountId, account: AccountId) {
assert!(
self.whitelist_tokens.get(&token).is_some(),
"The whitelisted token mode is not set"
);
let token_account_key = get_token_account_key(token, account);
assert!(
self.whitelist_accounts.insert(&token_account_key),
"Account is already whitelisted for the given token"
);
}
05Section · Resolution

Resolution

Acknowledged.

F-2024-0005

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx