Description

The function editToken allows the contract owner to edit token details stored in the contract.

function editToken(address _address, TokenLaunchData memory data) public onlyOwner tokenExists(_address) {
    PondStorage storage $ = _getStorage();
    Token storage token = $.tokens[_address];

    token.title = data.title;
    token.symbol = data.symbol;
    token.description = data.description;
    token.imageUrl = data.imageUrl;
    token.links = data.links;
}

However, the function does not edit the ERC-20 token name and symbol stored in the token contract, which is only set when it is deployed.

Impact

Editing the token title or symbol will cause a display discrepancy between the ERC20's fields and the ones used by the frontend. This may confuse users after DEX deployment.

Recommendations

If the goal of the function is to fully edit the token, then the PondERC20 contract should implement such an update mechanism. If the goal is to change details only on the front end, then the function needs to be clearly documented.

Remediation

This issue has been acknowledged by PondFun, and a fix was implemented in commit 2a039ef1↗. PondFun has removed the possibility of editing tokens after creation.