function removeFromTokenWhitelist(address addr) external {
    require(isAdmin(msg.sender), "ADM");
    _tokensAllowed[addr] = false;
    if (_tokenEverAdded[addr]) {
        // @audit admin can repeatedly call this function and sets _numberOfValidTokens to zero. because they don't flip _tokenEverAdded[addr] here
        --_numberOfValidTokens;
    }
}
function removeFromTokenWhitelist(address addr) external {
    require(isAdmin(msg.sender), "ADM");
    if (_tokensAllowed[addr]) {
        _tokensAllowed[addr] = false;
        --_numberOfValidTokens;
    }
}
