Auctioneer Cannot Be Removed From The Protocol
If a vulnerable Auctioneer is being exploited by an attacker, there is no way to remove the vulnerable Auctioneer from the protocol.\\nThe protocol is missing the feature to remove an auctioneer. Once an auctioneer has been added to the whitelist, it is not possible to remove the auctioneer from the whitelist.\\n```\\nFile: BondAggregator.sol\\n    function registerAuctioneer(IBondAuctioneer auctioneer_) external requiresAuth {\\n        // Restricted to authorized addresses\\n\\n        // Check that the auctioneer is not already registered\\n        if (_whitelist[address(auctioneer_)])\\n            revert Aggregator_AlreadyRegistered(address(auctioneer_));\\n\\n        // Add the auctioneer to the whitelist\\n        auctioneers.push(auctioneer_);\\n        _whitelist[address(auctioneer_)] = true;\\n    }\\n```\\n
Consider implementing an additional function to allow the removal of an Auctioneer from the whitelist, so that vulnerable Auctioneer can be removed swiftly if needed.\\n```\\nfunction deregisterAuctioneer(IBondAuctioneer auctioneer_) external requiresAuth {\\n    // Remove the auctioneer from the whitelist\\n    _whitelist[address(auctioneer_)] = false;\\n}\\n```\\n
In the event that a whitelisted Auctioneer is found to be vulnerable and has been actively exploited by an attacker in the wild, the protocol needs to mitigate the issue swiftly by removing the vulnerable Auctioneer from the protocol. However, the mitigation effort will be hindered by the fact there is no way to remove an Auctioneer within the protocol once it has been whitelisted. Thus, it might not be possible to stop the attacker from exploiting the vulnerable Auctioneer. The protocol team would need to find a workaround to block the attack, which will introduce an unnecessary delay to the recovery process where every second counts.\\nAdditionally, if the admin accidentally whitelisted the wrong Auctioneer, there is no way to remove it.
```\\nFile: BondAggregator.sol\\n    function registerAuctioneer(IBondAuctioneer auctioneer_) external requiresAuth {\\n        // Restricted to authorized addresses\\n\\n        // Check that the auctioneer is not already registered\\n        if (_whitelist[address(auctioneer_)])\\n            revert Aggregator_AlreadyRegistered(address(auctioneer_));\\n\\n        // Add the auctioneer to the whitelist\\n        auctioneers.push(auctioneer_);\\n        _whitelist[address(auctioneer_)] = true;\\n    }\\n```\\n