feat: prevent duplicate collateral tokens

Resolves: sherlock-audit/2023-12-ubiquity-judging#145
ubiquity · Feb 24, 2024 · 02e700b · 02e700b
1 parent 38c3656
commit 02e700b
Show file tree

Hide file tree

Showing 2 changed files with 38 additions and 3 deletions.
diff --git a/packages/contracts/src/dollar/libraries/LibUbiquityPool.sol b/packages/contracts/src/dollar/libraries/LibUbiquityPool.sol
@@ -202,6 +202,24 @@ library LibUbiquityPool {
         return poolStorage.collateralAddresses;
     }
 
+    /**
+     * @notice Check if collateral token with given address already exists
+     * @param collateralAddress The collateral token address to check
+     */
+    function collateralExists(
+        address collateralAddress
+    ) internal view returns (bool) {
+        UbiquityPoolStorage storage poolStorage = ubiquityPoolStorage();
+        address[] memory collateralAddresses = poolStorage.collateralAddresses;
+
+        for (uint256 i = 0; i < collateralAddresses.length; i++) {
+            if (collateralAddresses[i] == collateralAddress) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     /**
      * @notice Returns collateral information
      * @param collateralAddress Address of the collateral token
@@ -533,10 +551,9 @@ library LibUbiquityPool {
             // roundId
             int256 answer, // startedAt
             ,
-            uint256 updatedAt,
+            uint256 updatedAt, // answeredInRound
 
-        ) = // answeredInRound
-            priceFeed.latestRoundData();
+        ) = priceFeed.latestRoundData();
 
         // fetch number of decimals in chainlink feed
         uint256 priceFeedDecimals = priceFeed.decimals();
@@ -631,6 +648,11 @@ library LibUbiquityPool {
         address chainLinkPriceFeedAddress,
         uint256 poolCeiling
     ) internal {
+        require(
+            !collateralExists(collateralAddress),
+            "Collateral already added"
+        );
+
         UbiquityPoolStorage storage poolStorage = ubiquityPoolStorage();
 
         uint256 collateralIndex = poolStorage.collateralAddresses.length;

diff --git a/packages/contracts/test/diamond/facets/UbiquityPoolFacet.t.sol b/packages/contracts/test/diamond/facets/UbiquityPoolFacet.t.sol
@@ -692,6 +692,19 @@ contract UbiquityPoolFacetTest is DiamondTestSetup {
         assertEq(info.redemptionFee, 20000);
     }
 
+    function testAddCollateralToken_ShouldRevertIfCollateralAlreadyExists()
+        public
+    {
+        uint256 poolCeiling = 50_000e18;
+        vm.startPrank(admin);
+        vm.expectRevert("Collateral already added");
+        ubiquityPoolFacet.addCollateralToken(
+            address(collateralToken),
+            address(collateralTokenPriceFeed),
+            poolCeiling
+        );
+    }
+
     function testRemoveAmoMinter_ShouldRemoveAmoMinter() public {
         vm.startPrank(admin);