cergyk - Attacker can block funding for OngoingBounty if paymentTokenAddress is non-whitelisted

[github-actions]

cergyk

medium

Attacker can block funding for OngoingBounty if paymentTokenAddress is non-whitelisted

Summary

In an OngoingBountyV1 type, the bounty issuer decides the payment token, and the bounty winner has only access to the payment in payoutTokenAddress. However a malicious user can block funding for payoutTokenAddress if it is not whitelisted in TokenWhitelist by funding with dust in multiple other non whitelisted tokens to reach openQTokenWhitelist.TOKEN_ADDRESS_LIMIT().

Vulnerability Detail

Impact

Funding in not-whitelisted payoutTokenAddress is blocked rendering the bounty Useless. A new bounty has to be created.

Code Snippet

Tool used

Manual Review

Recommendation

Add the payoutTokenAddress to the list of tokenAddresses in BountyCore, on creation of an OngoingBounty

the adding can be done in the initialization of the bounty:
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/OngoingBountyV1.sol#L89

Duplicate of #530