Modifying utilitytoken would result in loss of user assets

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/HolographOperator.sol#L1049-L1053

Vulnerability details

Impact

The administrator can set utilityToken at will without any restrictions. Modifications impress the assets of the operator. For example, previously utilityToken was a high-price utilitytoken, and the user bondUtilityToken() would send high-price tokens. Then the administrator can modify the utilityToken to a lower-priced one. The operator then does unbondUtilityToken(), which can only get tokens that have a lower price than before or that have no value.

Proof of Concept

  function setUtilityToken(address utilityToken) external onlyAdmin {
    assembly {
      sstore(_utilityTokenSlot, utilityToken) //@audit 
    }
  }

Tools Used

vscode

Recommended Mitigation Steps

Add a time lock or determine whether an operator currently exists

[gzeoneth]

Could be Low/QA, centralization risk

[alexanderattar]

Low risk, but will consider adding a timelock in future update

[gzeoneth]

Consider with #62