SJIP: Update the guideline about accidental token transfers.

[WangSecurity]

Description

Update the guideline about accidental token transfers to apply to all tokens.

Judging Guidelines PR

https://github.com/sherlock-protocol/sherlock-v2-docs/pull/59/files

Rationale

The guideline is confusing to newcomers as the current guideline only talks about native tokens, which may lead to them thinking it doesn't apply to any other tokens. However, accidental token transfers are always considered a user mistake, so the goal of this SJIP is to clarify that issues about directly transferring any tokens are considered invalid.

Relevant Issue Discussions

No specific discussion.

[IllIllI000]

The updated language makes it seem as though if there's a bug where the user performs legitimate protocol operations in a certain order which will cause them to lose their funds due to a bug, that that's considered a user error and is therefore invalid.

[WangSecurity]

Hmm, interesting, do you think adding the word "direct" would resolve this confusion?

Accidental direct token transfers: users accidentally directly transferring any tokens (native, ERC20, etc.), while the contract doesn't have a way to retrieve them, is not valid as a medium/high issue and is considered a user mistake.

Or do you think we need to clarify even further, like the following, cause I think sometimes contracts require you to first send funds and then call the function:

Accidental direct token transfers: users accidentally directly transferring any tokens (native, ERC20, etc.), while it is not a part of the expected protocol operations and the contract doesn't have a way to retrieve them, is not valid as a medium/high issue and is considered a user mistake.

[IllIllI000]

The second one, but perhaps with the following changes:

users accidentally or intentionally directly transferring any tokens (native, ERC20, etc.) to the contracts ...

[WangSecurity]

I'm not sure this sounds right, tbh. If we put it like that, it reads like any issue involving direct transfers of tokens into the contracts is invalid. What about this:

Accidental direct token transfers: users accidentally or intentionally directly transferring any tokens (native, ERC20, etc.) into the in-scope contracts, while it is not a part of the expected protocol operations, and the contract doesn't have a way to retrieve them, is not valid as a medium/high issue and is considered a user mistake, if the user hurts themselves only. However, if it leads to hurting the protocol and/or other users, it may be considered a valid issue.

[WangSecurity]

Updated the PR.