https://ghostforum.org/t/ghost-dao-contracts-unregistered-quote-token-markets-accrue-invisible-value-auditreserves-cannot-rescue-the-bond-halt-for-them/171

Signed-off-by: Uncle Fatso <uncle.fatso@ghostchain.io>

src/BondDepository.sol

@@ -161,6 +161,11 @@ contract GhostBondDepository is IBondDepository, NoteKeeper {
             msg.sender != IGhostAuthority(AUTHORITY).policy()
         ) revert NotGuardianOrPolicy();
 
+        if (
+            !ITreasury(TREASURY).registered(ITreasury.STATUS.RESERVETOKEN, _quoteToken) &&
+            !ITreasury(TREASURY).registered(ITreasury.STATUS.LIQUIDITYTOKEN, _quoteToken)
+        ) revert NonPermissionedToken();
+
         uint256 secondsToConclusion = _terms[1] - block.timestamp;
         uint256 decimals = IERC20Metadata(_quoteToken).decimals();
         uint64 targetDebt = uint64(_booleans[0]

src/Treasury.sol

@@ -25,9 +25,7 @@ contract GhostTreasury is GhostAccessControlled, ITreasury {
     using EnumerableSet for EnumerableSet.AddressSet;
 
     address public immutable FTSO;
-
     uint256 public totalReserves;
-    uint256 public totalDebt;
 
     mapping(STATUS => EnumerableSet.AddressSet) private _registry;
     mapping(STATUS => mapping(address => bool)) private _permissions;
@@ -62,9 +60,10 @@ contract GhostTreasury is GhostAccessControlled, ITreasury {
 
     function mint(address recipient, uint256 amount) external override {
         if (!_permissions[STATUS.REWARDMANAGER][msg.sender]) revert NotApproved();
-        if (amount > excessReserves()) revert InsufficientReserves();
-        IFTSO(FTSO).mint(recipient, amount);
-        emit Minted(msg.sender, recipient, amount);
+        if (amount <= excessReserves()) {
+            IFTSO(FTSO).mint(recipient, amount);
+            emit Minted(msg.sender, recipient, amount);
+        }
     }
 
     function withdraw(address token, uint256 amount) external onlyGovernor override {
@@ -90,8 +89,9 @@ contract GhostTreasury is GhostAccessControlled, ITreasury {
         gasValue = tokenValue(reserveToken, gasSpent);
         gasValue = FullMath.mulDiv(gasValue, totalSupply, totalReserves);
 
-        if (gasValue > excessReserves()) revert InsufficientReserves();
-        IFTSO(FTSO).mint(msg.sender, gasValue);
+        if (gasValue <= excessReserves()) {
+            IFTSO(FTSO).mint(msg.sender, gasValue);
+        }
     }
 
     function buyBack(
@@ -247,7 +247,7 @@ contract GhostTreasury is GhostAccessControlled, ITreasury {
         return _permissions[status][someAddress];
     }
 
-    function registered(STATUS status, address someAddress) external view returns (bool) {
+    function registered(STATUS status, address someAddress) external override view returns (bool) {
         return _registry[status].contains(someAddress);
     }
 
@@ -257,7 +257,12 @@ contract GhostTreasury is GhostAccessControlled, ITreasury {
     }
 
     function excessReserves() public view override returns (uint256) {
-        return totalReserves - (IFTSO(FTSO).totalSupply() - totalDebt);
+        uint256 ftsoSupply = IFTSO(FTSO).totalSupply();
+        uint256 currentTotalReserves = totalReserves;
+
+        return currentTotalReserves > ftsoSupply
+            ? currentTotalReserves - ftsoSupply
+            : 0;
     }
 
     function tokenValue(

src/interfaces/IBondDepository.sol

@@ -6,6 +6,7 @@ interface IBondDepository {
     error DepositoryMaxPrice(uint256 price, uint256 maxPrice);
     error DepositoryMaxSize(uint256 payout, uint256 maxPayout);
     error NotGuardianOrPolicy();
+    error NonPermissionedToken();
 
     event MarketClosed(uint256 indexed id);
     event Bond(uint256 indexed id, uint256 amount, uint256 price);

src/interfaces/ITreasury.sol

@@ -6,7 +6,6 @@ interface ITreasury {
     error NotAccepted();
     error InvalidToken();
     error GasExceedsBounty();
-    error InsufficientReserves();
 
     enum STATUS {
         RESERVEDEPOSITOR,
@@ -29,6 +28,7 @@ interface ITreasury {
         uint256 _profit
     ) external returns (uint256);
 
+    function registered(STATUS status, address token) external view returns(bool);
     function phantomRefund(uint256 gasSpent, uint256 amount) external returns (uint256);
     function buyBack(address receiver, uint256 amount, uint256 index) external returns (address, uint256);
     function withdraw(address token, uint256 amount) external;