Fix vault issue.

1Hive · May 29, 2020 · dab591f · dab591f
1 parent 06d2d2e
commit dab591f
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/contracts/TokenRequest.sol b/contracts/TokenRequest.sol
@@ -263,4 +263,11 @@ contract TokenRequest is AragonApp {
         return tokenManager.token();
     }
 
+    /**
+    * @dev Disable recovery escape hatch, as it could be used
+    *      maliciously to transfer funds away from TokenRequest
+    */
+    function allowRecoverability(address token) public view returns (bool) {
+        return false;
+    }
 }
diff --git a/test/TokenRequestTest.js b/test/TokenRequestTest.js
@@ -461,7 +461,7 @@ contract('TokenRequest', ([rootAccount, ...accounts]) => {
       })
     })
 
-    describe('refundTokenRequest(uint256 _tokenRequestId) ', () => {
+    describe('refundTokenRequest(uint256 _tokenRequestId)', () => {
       const refundEthAccount = accounts[2]
       it('refund token (ERC20)', async () => {
         const refundAmount = 100
@@ -567,5 +567,13 @@ contract('TokenRequest', ([rootAccount, ...accounts]) => {
         await assertRevert(tokenRequest.refundTokenRequest(1, { from: refundEthAccount }), 'TOKEN_REQUEST_NO_REQUEST')
       })
     })
+
+    describe('transferToVault(address _token)', () => {
+      it('reverts', async () => {
+        await assertRevert(
+          tokenRequest.transferToVault(mockErc20.address),
+          'RECOVER_DISALLOWED')
+      })
+    })
   })
 })