Submitted by GalloDaSballo
The assumption that a yield source is valid, just because it has the method depositToken, is not a security guarantee. I could create any random contract with that function but that is not a guarantee that the contract will behave as intended.
I believe a better solution would be to have a registry, controlled by governance, that accepts the valid yield sources. A valid registry ensures the the yield sources are properly maintained.
In summary: There is no security difference between having the check and not having the check, because the check can be sidelined without any effort and doesnt truly provide any guarantee of the contract being valid. Having no checks would save you gas. While having a governance registry would guarantee that the yield sources usable are exclusively the community vetted ones.
asselstine (PoolTogether) acknowledged:
