L-13·

PoolAdminFacet: `removeToken()` lacks protocol fee check

Not reportedoptionsleverageblack-scholes

TL;DR

The removeToken function does not check if a token has a non-zero protocol fee before removal.

Severity

LOW

Method

MManual review

CAT.

The removeToken function does not check if a token has a non-zero protocol fee before removal. This can prevent the feeDistributor from claiming fees after the token is removed.

solidity

function removeToken(address _token) external onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {
    PoolStorage.Layout storage strg = PoolStorage.layout();
    if (strg.ledger.state.poolAmount[_token] != 0) revert PoolErrors.PoolNotEmpty(_token);
    strg.setUp.assets.allAssets.remove(_token);
    strg.setUp.assets.stablecoins.remove(_token);

    if (strg.ledger.state.rewardsByToken[_token].totalRewards == 0) strg.setUp.assets.rewardTokens.remove(_token);
}

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.