137.md

Broad Jetblack Alligator

Medium

Inaccessible Whitelist Management Function in the SolidlyV2AMO.sol Contract

Summary

The permanent inaccessibility of the SolidlyV2Amo.sol::setWhitelistedTokens function will limit the protocol's ability to adapt. This will prevent administrators from updating the approved reward tokens https://github.com/sherlock-audit/2024-10-axion/blob/c65e662999d0c79439703fc6713814b4ad023e01/liquidity-amo/contracts/SolidlyV2AMO.sol#L148

Root Cause

In SolidlyV2AMO.sol, the SETTER_ROLE is revoked in the initialize function after initial setup, and there's no mechanism to reassign this role. The setWhitelistedTokens function, which requires the SETTER_ROLE, becomes permanently inaccessible.

Internal pre-conditions

1. SolidlyV2AMO contract needs to be deployed and initialized.
2. The initialize function revokes the SETTER_ROLE from the msg.sender.
3. No function exists to reassign the SETTER_ROLE after initialization.

External pre-conditions

No response

Attack Path

1. The contract is deployed and initialized.
2. The SETTER_ROLE is automatically revoked from the deployer.
3. Attempts to call setWhitelistedTokens will revert due to lacking SETTER_ROLE.
4. The contract cannot add any whitelisted tokens.

Impact

The protocol cannot add any whitelisted tokens including (FOT).

PoC

No response

Mitigation

1. Add the setWhitelistedTokens functionality directly within the initialize function, setting up the initial whitelist during contract deployment. Alternately, you can assign a different role to this function to make it accessible.