Submitted by cmichel
The Gov.tokenInit skips the underlying token check if the _token is SHERX:
This check should still be performed even for _token == address(this) // SHERX, otherwise, the lock can have a different underlying and potentially pay out wrong tokens.
Recommendation is to verify the underlying of all locks.
Evert0x (Sherlock) confirmed
Evert0x (Sherlock) commented:
