Teller Cannot Be Removed From Callback Contract
If a vulnerable Teller is being exploited by an attacker, there is no way for the owner of the Callback Contract to remove the vulnerable Teller from their Callback Contract.\\nThe Callback Contract is missing the feature to remove a Teller. Once a Teller has been added to the whitelist (approvedMarkets mapping), it is not possible to remove the Teller from the whitelist.\\n```\\nFile: BondBaseCallback.sol\\n    /* ========== WHITELISTING ========== */\\n\\n    /// @inheritdoc IBondCallback\\n    function whitelist(address teller_, uint256 id_) external override onlyOwner {\\n        // Check that the market id is a valid, live market on the aggregator\\n        try _aggregator.isLive(id_) returns (bool live) {\\n            if (!live) revert Callback_MarketNotSupported(id_);\\n        } catch {\\n            revert Callback_MarketNotSupported(id_);\\n        }\\n\\n        // Check that the provided teller is the teller for the market ID on the stored aggregator\\n        // We could pull the teller from the aggregator, but requiring the teller to be passed in\\n        // is more explicit about which contract is being whitelisted\\n        if (teller_ != address(_aggregator.getTeller(id_))) revert Callback_TellerMismatch();\\n\\n        approvedMarkets[teller_][id_] = true;\\n    }\\n```\\n
Consider implementing an additional function to allow the removal of a Teller from the whitelist (approvedMarkets mapping), so that a vulnerable Teller can be removed swiftly if needed.\\n```\\nfunction removeFromWhitelist(address teller_, uint256 id_) external override onlyOwner {\\n    approvedMarkets[teller_][id_] = false;\\n}\\n```\\n\\nNote: Although the owner of the Callback Contract can DOS its own market by abusing the `removeFromWhitelist` function, no sensible owner would do so.
In the event that a whitelisted Teller is found to be vulnerable and has been actively exploited by an attacker in the wild, the owner of the Callback Contract needs to mitigate the issue swiftly by removing the vulnerable Teller from the Callback Contract to stop it from draining the asset within the Callback Contract. However, the mitigation effort will be hindered by the fact there is no way to remove a Teller within the Callback Contract once it has been whitelisted. Thus, it might not be possible to stop the attacker from exploiting the vulnerable Teller to drain assets within the Callback Contract. The Callback Contract owners would need to find a workaround to block the attack, which will introduce an unnecessary delay to the recovery process where every second counts.\\nAdditionally, if the owner accidentally whitelisted the wrong Teller, there is no way to remove it.
```\\nFile: BondBaseCallback.sol\\n    /* ========== WHITELISTING ========== */\\n\\n    /// @inheritdoc IBondCallback\\n    function whitelist(address teller_, uint256 id_) external override onlyOwner {\\n        // Check that the market id is a valid, live market on the aggregator\\n        try _aggregator.isLive(id_) returns (bool live) {\\n            if (!live) revert Callback_MarketNotSupported(id_);\\n        } catch {\\n            revert Callback_MarketNotSupported(id_);\\n        }\\n\\n        // Check that the provided teller is the teller for the market ID on the stored aggregator\\n        // We could pull the teller from the aggregator, but requiring the teller to be passed in\\n        // is more explicit about which contract is being whitelisted\\n        if (teller_ != address(_aggregator.getTeller(id_))) revert Callback_TellerMismatch();\\n\\n        approvedMarkets[teller_][id_] = true;\\n    }\\n```\\n