https://ghostforum.org/t/ghost-dao-contracts-unregistered-quote-token-markets-accrue-invisible-value-auditreserves-cannot-rescue-the-bond-halt-for-them/171

Signed-off-by: Uncle Fatso <uncle.fatso@ghostchain.io>

src/BondDepository.sol

@@ -161,6 +161,11 @@ contract GhostBondDepository is IBondDepository, NoteKeeper {
             msg.sender != IGhostAuthority(AUTHORITY).policy()
         ) revert NotGuardianOrPolicy();
 
+        if (
+            !ITreasury(TREASURY).registered(ITreasury.STATUS.RESERVETOKEN, _quoteToken) &&
+            !ITreasury(TREASURY).registered(ITreasury.STATUS.LIQUIDITYTOKEN, _quoteToken)
+        ) revert NonPermissionedToken();
+
         uint256 secondsToConclusion = _terms[1] - block.timestamp;
         uint256 decimals = IERC20Metadata(_quoteToken).decimals();
         uint64 targetDebt = uint64(_booleans[0]

src/Treasury.sol

@@ -247,7 +247,7 @@ contract GhostTreasury is GhostAccessControlled, ITreasury {
         return _permissions[status][someAddress];
     }
 
-    function registered(STATUS status, address someAddress) external view returns (bool) {
+    function registered(STATUS status, address someAddress) external override view returns (bool) {
         return _registry[status].contains(someAddress);
     }
 

src/interfaces/IBondDepository.sol

@@ -6,6 +6,7 @@ interface IBondDepository {
     error DepositoryMaxPrice(uint256 price, uint256 maxPrice);
     error DepositoryMaxSize(uint256 payout, uint256 maxPayout);
     error NotGuardianOrPolicy();
+    error NonPermissionedToken();
 
     event MarketClosed(uint256 indexed id);
     event Bond(uint256 indexed id, uint256 amount, uint256 price);

src/interfaces/ITreasury.sol

@@ -28,6 +28,7 @@ interface ITreasury {
         uint256 _profit
     ) external returns (uint256);
 
+    function registered(STATUS status, address token) external view returns(bool);
     function phantomRefund(uint256 gasSpent, uint256 amount) external returns (uint256);
     function buyBack(address receiver, uint256 amount, uint256 index) external returns (address, uint256);
     function withdraw(address token, uint256 amount) external;