# Token addresses are not validated in BRC20Factory and Vault, so users can use incorrect tokens Low/Info · Three Sigma · Cross-chain bridge · 15th July, 2024 Finding 3S-OB-L02 of the Orange Bridge security review. - Protocol: https://www.orangeweb3.com/ - Report: /reports/orange - Source: https://cdn.sanity.io/files/qoqld077/production/686ad4e1d5035d69002f5f97e281e3c5a8b7ce00.pdf --- ### Description BRC20Factory::mint(), BRC20Factory::burn(), Vault::deposit() and Vault::withdraw() allow sending any token, which could lead to problems if the token is not a BRC20. ### Recommendation Validate the sent token was created by the factory. To do this an isBRC20 mapping should be added to BRC20Factory which stores all the tokens that were created by it. ### Status Addressed in [#1cd9410](https://github.com/orangecryptohq/orange-bridge-contract/commit/1cd9410115102d52913a2e863b78f21d110e0e2d). --- Related findings: - [BasicVaultFactory::createVault() inconsistent already existing vault check](https://0xsimao.com/findings/mitosis-create-inconsistent-already-existing): Mitosis - [`fyToken` contribution limits are incorrect as they compare `fyToken` and `buyToken` amounts with `idoSize` in `idoToken` units](https://0xsimao.com/findings/blast-ido-pools-contribution-limits-compare-buy): Blast IDO Pools - [Cancelling rounds after finalizing will lead to incorrect `globalTokenAllocPerIDORound` tracking](https://0xsimao.com/findings/blast-ido-pools-finalizing-alloc-round-tracking): Blast IDO Pools - [The incorrect accounting of protocol fee will cause double charging fee and wrong distribution of earnings for variable users](https://0xsimao.com/findings/saffron-lido-vaults-accounting-fee-double-charging): Saffron Lido Vaults