Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-27·

Token removal can be blocked by minimal deposits

Not reportedoptionsleverageblack-scholes
TL;DR

In the current implementation, the protocol's token removal functionality can be permanently blocked by a malicious actor through a minimal token deposit.

Severity
LOW
Method
MManual review
CAT.

In the current implementation, the protocol's token removal functionality can be permanently blocked by a malicious actor through a minimal token deposit. This vulnerability exists due to the strict validation in PoolAdminFacet.sol:

solidity
function removeToken(address _token) external onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {
PoolStorage.Layout storage strg = PoolStorage.layout();
if (strg.ledger.state.poolAmount[_token] != 0) revert PoolErrors.PoolNotEmpty(_token);
strg.setUp.assets.allAssets.remove(_token);
strg.setUp.assets.stablecoins.remove(_token);
if (strg.ledger.state.rewardsByToken[_token].totalRewards == 0) strg.setUp.assets.rewardTokens.remove(_token);
}

Any user can deposit a minimal amount (as small as 1 wei) of a token into the pool. Once a token has any non-zero balance, the admin cannot remove it from the protocol. This creates a permanent denial-of-service (DOS) vector for token removal functionality.

This issue is more severe if one of the stable coins depends. Being Unable to remove the coin from the strg.setUp.assets.stablecoins could cause an incorrect getPoolValue calculation.

Recommendations:

Implement a more robust token removal system that allows administrators to remove tokens even with minimal balance.

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-27