Token removal can be blocked by minimal deposits
In the current implementation, the protocol's token removal functionality can be permanently blocked by a malicious actor through a minimal token deposit.
In the current implementation, the protocol's token removal functionality can be permanently blocked by a malicious actor through a minimal token deposit. This vulnerability exists due to the strict validation in PoolAdminFacet.sol:
function removeToken(address _token) external onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {PoolStorage.Layout storage strg = PoolStorage.layout();if (strg.ledger.state.poolAmount[_token] != 0) revert PoolErrors.PoolNotEmpty(_token);strg.setUp.assets.allAssets.remove(_token);strg.setUp.assets.stablecoins.remove(_token);if (strg.ledger.state.rewardsByToken[_token].totalRewards == 0) strg.setUp.assets.rewardTokens.remove(_token);}
Any user can deposit a minimal amount (as small as 1 wei) of a token into the pool. Once a token has any non-zero balance, the admin cannot remove it from the protocol. This creates a permanent denial-of-service (DOS) vector for token removal functionality.
This issue is more severe if one of the stable coins depends. Being Unable to remove the coin from the strg.setUp.assets.stablecoins could cause an incorrect getPoolValue calculation.
Recommendations:
Implement a more robust token removal system that allows administrators to remove tokens even with minimal balance.
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.