From b06f6c115f6b5ab30a54e6f33beb14947d0f8dbd Mon Sep 17 00:00:00 2001 From: Uncle Fatso Date: Fri, 23 Oct 2026 17:30:47 +0300 Subject: [PATCH] permission checks added to be more safe during bond creation Signed-off-by: Uncle Fatso --- src/BondDepository.sol | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/BondDepository.sol b/src/BondDepository.sol index 66ff7bc..17c1bca 100644 --- a/src/BondDepository.sol +++ b/src/BondDepository.sol @@ -166,10 +166,17 @@ contract GhostBondDepository is IBondDepository, NoteKeeper { msg.sender != IGhostAuthority(AUTHORITY).policy() ) revert NotGuardianOrPolicy(); - if ( - !ITreasury(TREASURY).registered(ITreasury.STATUS.RESERVETOKEN, _quoteToken) && - !ITreasury(TREASURY).registered(ITreasury.STATUS.LIQUIDITYTOKEN, _quoteToken) - ) revert NonPermissionedToken(); + { + bool isReserve = + ITreasury(TREASURY).registered(ITreasury.STATUS.RESERVETOKEN, _quoteToken) && + ITreasury(TREASURY).permissioned(ITreasury.STATUS.RESERVETOKEN, _quoteToken); + + bool isLiquidity = + ITreasury(TREASURY).registered(ITreasury.STATUS.LIQUIDITYTOKEN, _quoteToken) && + ITreasury(TREASURY).permissioned(ITreasury.STATUS.LIQUIDITYTOKEN, _quoteToken); + + if (!isReserve && !isLiquidity) revert NonPermissionedToken(); + } uint256 secondsToConclusion = _terms[1] - block.timestamp; uint256 decimals = IERC20Metadata(_quoteToken).decimals();