Submitted by TerrierLover
PaladinRewardReserve.sol may have potential bugs if it uses new tokens as rewards.
Currently, PaladinRewardReserve.sol has following behaviors:
Hence, some corner cases may happen as follows:
Do either of followings depending on the product specification:
(1) If PAL token is only used and other token will never be used at PaladinRewardReserve.sol, stop having address token argument at setNewSpender, updateSpenderAllowance, removeSpender and transferToken functions. Instead, set token at the constructor or other ways, and limit the ability to flexibly set token from functions.
(2) If other tokens potentially will be used at PaladinRewardReserve.sol, update data structure of approvedSpenders mapping and change the logic.
Firstly, it should also contain the info which token it targets such as mapping(address => address => bool).
Secondly, it should rewrite the require logic at each function as follows.
Kogaroshi (Paladin) confirmed, resolved, and commented:
