From 5e3454b502694786d67af5e13e192e3a852c51f2 Mon Sep 17 00:00:00 2001 From: Uncle Fatso Date: Mon, 12 Oct 2026 12:49:35 +0300 Subject: [PATCH] https://ghostforum.org/t/ghost-dao-contracts-unregistered-quote-token-markets-accrue-invisible-value-auditreserves-cannot-rescue-the-bond-halt-for-them/171 Signed-off-by: Uncle Fatso --- src/BondDepository.sol | 5 +++++ src/Treasury.sol | 2 +- src/interfaces/IBondDepository.sol | 1 + src/interfaces/ITreasury.sol | 1 + 4 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/BondDepository.sol b/src/BondDepository.sol index fac0fa9..1aa9de3 100644 --- a/src/BondDepository.sol +++ b/src/BondDepository.sol @@ -161,6 +161,11 @@ contract GhostBondDepository is IBondDepository, NoteKeeper { msg.sender != IGhostAuthority(AUTHORITY).policy() ) revert NotGuardianOrPolicy(); + if ( + !ITreasury(TREASURY).registered(ITreasury.STATUS.RESERVETOKEN, _quoteToken) && + !ITreasury(TREASURY).registered(ITreasury.STATUS.LIQUIDITYTOKEN, _quoteToken) + ) revert NonPermissionedToken(); + uint256 secondsToConclusion = _terms[1] - block.timestamp; uint256 decimals = IERC20Metadata(_quoteToken).decimals(); uint64 targetDebt = uint64(_booleans[0] diff --git a/src/Treasury.sol b/src/Treasury.sol index 3731e30..26edc83 100644 --- a/src/Treasury.sol +++ b/src/Treasury.sol @@ -247,7 +247,7 @@ contract GhostTreasury is GhostAccessControlled, ITreasury { return _permissions[status][someAddress]; } - function registered(STATUS status, address someAddress) external view returns (bool) { + function registered(STATUS status, address someAddress) external override view returns (bool) { return _registry[status].contains(someAddress); } diff --git a/src/interfaces/IBondDepository.sol b/src/interfaces/IBondDepository.sol index 9c32229..585eb29 100644 --- a/src/interfaces/IBondDepository.sol +++ b/src/interfaces/IBondDepository.sol @@ -6,6 +6,7 @@ interface IBondDepository { error DepositoryMaxPrice(uint256 price, uint256 maxPrice); error DepositoryMaxSize(uint256 payout, uint256 maxPayout); error NotGuardianOrPolicy(); + error NonPermissionedToken(); event MarketClosed(uint256 indexed id); event Bond(uint256 indexed id, uint256 amount, uint256 price); diff --git a/src/interfaces/ITreasury.sol b/src/interfaces/ITreasury.sol index 8b7f9eb..511be89 100644 --- a/src/interfaces/ITreasury.sol +++ b/src/interfaces/ITreasury.sol @@ -28,6 +28,7 @@ interface ITreasury { uint256 _profit ) external returns (uint256); + function registered(STATUS status, address token) external view returns(bool); function phantomRefund(uint256 gasSpent, uint256 amount) external returns (uint256); function buyBack(address receiver, uint256 amount, uint256 index) external returns (address, uint256); function withdraw(address token, uint256 amount) external;