Submitted by IllIllI
Pool owners can prevent taxes from being paid without impacting any other functionality
By adding a custom reward token that always reverts for transfers to globalBenericiary, the owner can prevent taxes from being paid:
https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/PermissionlessBasicPoolFactory.sol#L258-L272
While the sponsor mentions that malicious tokens make the pool malicious, this particular issue has a simple fix outlined below in the mitigation section
Force taxes to be paid during withdraw()
illuzen (FactoryDAO) confirmed, disagreed with severity and commented:
illuzen (FactoryDAO) resolved:
Justin Goro (judge) commented:
