admin can lock funds

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/contracts/rubiconPools/BathHouse.sol#L216-L229

Vulnerability details

description

using the adminWriteBathToken function in BathHouse.sol, the admin can arbitrarily change the bath token address. If done maliciously can lock underlying funds of users who have deposited into that bath token

/2022-05-rubicon/contracts/rubiconPools/BathHouse.sol
216:     /// @notice A migration function that allows the admin to write arbitrarily to tokenToBathToken
217:     function adminWriteBathToken(ERC20 overwriteERC20, address newBathToken)
218:         external
219:         onlyAdmin
220:     {
221:         tokenToBathToken[address(overwriteERC20)] = newBathToken;
222:         emit LogNewBathToken(
223:             address(overwriteERC20),
224:             newBathToken,
225:             address(0),
226:             block.timestamp,
227:             msg.sender
228:         );
229:     }

[HickupHH3]

duplicate of #249