Nested Finance contest - gpersoon's results

Handle

gpersoon

Vulnerability details

Impact

The function removeOperator of NestedFactory.sol doesn't work as expected. If you try to remove the first operator then i will be 0 and the "require(i > 0, ..." will stop the execution.

If you try to remove a non existing operator then i will reach operators[i].length. I will be our of range of the array. Then all uses of operators[i] will fail.

Proof of Concept

https://github.com/code-423n4/2021-11-nested/blob/5d113967cdf7c9ee29802e1ecb176c656386fe9b/contracts/NestedFactory.sol#L79-L86

function removeOperator(bytes32 operator) external override onlyOwner {
        uint256 i = 0;
        while (operators[i] != operator) {
            i++;
        }
        require(i > 0, "NestedFactory::removeOperator: Cant remove non-existent operator");
        delete operators[i];
    }

Tools Used

Recommended Mitigation Steps

Change the code to:

        uint256 i = 0;
        while ( i<operators.length && operators[i] != x) {
            i++;
        }
        require(i < operators.length, "NestedFactory::removeOperator: Cant remove non-existent operator");
        delete operators[i];