Submitted by 0xRajeev
The modifier onlyControlledToken is used for functions that allow the controlledToken address as a parameter to ensure that only whitelisted tokens (ticket and sponsorship) are provided. This is used in all functions except calculateEarlyExitFee().
The use of a non-whitelisted controlledToken will result in calls to potentially malicious token contract and cause undefined behavior for the from user address specified in the call.
Recommend adding missing modifier onlyControlledToken to calculateEarlyExitFee().
kamescg (PoolTogether) confirmed:
asselstine (PoolTogether) commented:
