Vulnerability: Updating interfaces of derivatives is done in a dangerous and unpredictable manner.
Severity: medium

Description:
Geode Finance codebase provides planet maintainers with the ability to enable or disable different contracts to act as the main token contract. In fact, multiple separate contracts can be used at the same time if decided so by the planet maintainer. Those contracts will have shared balances but will not share the allowances as you can see below:\\n```\\nmapping(uint256 => mapping(address => uint256)) private \\_balances;\\n```\\n\\n```\\nmapping(address => mapping(address => uint256)) private \\_allowances;\\n```\\n\\nUnfortunately, this approach comes with some implications that are very hard to predict as they involve interactions with other systems, but is possible to say that the consequences of those implications will most always be negative. We will not be able to outline all the implications of this issue, but we can try and outline the pattern that they all would follow.\\nThere are really two ways to update an interface: set the new one and immediately unset the old one, or have them both run in parallel for some time. Let's look at them one by one.\\nin the first case, the old interface is disabled immediately. Given that interfaces share balances that will lead to some very serious consequences. Imagine the following sequence:\\nAlice deposits her derivatives into the DWP contract for liquidity mining.\\nPlanet maintainer updates the interface and immediately disables the old one.\\nDWP contract now has the old tokens and the new ones. But only the new ones are accounted for in the storage and thus can be withdrawn. Unfortunately, the old tokens are disabled meaning that now both old and new tokens are lost.\\nThis can happen in pretty much any contract and not just the DWP token. Unless the holders had enough time to withdraw the derivatives back to their wallets all the funds deposited into contracts could be lost.\\nThis leads us to the second case where the two interfaces are active in parallel. This would solve the issue above by allowing Alice to withdraw the old tokens from the DWP and make the new tokens follow. Unfortunately, there is an issue in that case as well.\\nSome DeFi contracts allow their owners to withdraw any tokens that are not accounted for by the internal accounting. DWP allows the withdrawal of admin fees if the contract has more tokens than `balances[]` store. Some contracts even allow to withdraw funds that were accidentally sent to the contract by people. Either to recover them or just as a part of dust collection. Let's call such contracts “dangerous contracts” for our purposes.\\nAlice deposits her derivatives into the dangerous contract.\\nPlanet maintainer sets a new interface.\\nOwner of the dangerous contract sees that some odd and unaccounted tokens landed in the contract. He learns those are real and are part of Geode ecosystem. So he takes them.\\nOld tokens will follow the new tokens. That means Alice now has no claim to them and the contract that they just left has broken accounting since numbers there are not backed by tokens anymore.\\nOne other issue we would like to highlight here is that despite the contracts being expected to have separate allowances, if the old contract has the allowance set, the initial 0 value of the new one will be ignored. Here is an example:\\nAlice approves Bob for 100 derivatives.\\nPlanet maintainer sets a new interface. The new interface has no allowance from Alice to Bob.\\nBob still can transfer new tokens from Alice to himself by transferring the old tokens for which he still has the allowance. New token balances will be updated accordingly.\\nAlice could also give Bob an allowance of 100 tokens in the new contract since that was her original intent, but this would mean that Bob now has 200 token allowance.\\nThis is extremely convoluted and will most likely result in errors made by the planet maintainers when updating the interfaces.

Impact:

Recommended mitigation:
The safest option is to only allow a list of whitelisted interfaces to be used that are well-documented and audited. Planet maintainers could then choose the once that they see fit.