Centralization risks in BathToken

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-rubicon/blob/521d50b22b41b1f52ff9a67ea68ed8012c618da9/contracts/rubiconPools/BathHouse.sol#L225

Vulnerability details

Impact

A centralization problem could favor behaviors not expected by the investor/user.

Proof of Concept

An admin can overwrite a BathToken with one of their own, by setting the feeAddress to an arbitrary one and the emitted event will reflect that the address is address(0), which means it is charged by holders, since the emitted event deceives about the real result, it can encourage rouge pool scam behavior.

If it's a migration feature it should be limited to the first few blocks or the contract should be stopped.

/// @notice A migration function that allows the admin to write arbitrarily to tokenToBathToken

Affected source code:

• BathHouse.sol#L225

Recommended Mitigation Steps

• Remove this logic.
• Emit the event according the real values.

[bghughes]

Centralization risk is acknowledged #344

[HickupHH3]

Although there is centralisation risk, the impact and vulnerability isn't well described enough to warrant a medium severity rating. See #385 for instance.

[HickupHH3]

Part of warden's QA report: #47