Mimo August 2022 contest - tofunmi's results

Lines of code

https://github.com/code-423n4/2022-08-mimo/tree/main/contracts/proxy/MIMOProxy.sol#L127-L148

Vulnerability details

Impact

• The multicall function doesn't check the length of address[] calldata targets and *** bytes calldata data***, it doesn't check for zero address for targets too, not checking if they are equal means the unbalanced array would be a null address , which would return success if a call is made to it, and could lead to costly mistakes

Proof of Concept

• In a scenario where a user inputs the params, and targets[] and data[]'s length are not equal,the call would be made to a a zero address, and solidity returns success if a call is made to a zero address, smart contract logic shouldn't be based upon user's discretion. If one of the calls also requires transfer of funds, funds could be lost;

       │ File: contracts/proxy/MIMOProxy.sol

 127   │   function multicall(address[] calldata targets, bytes[] calldata data) external override returns (byte
       │ s[] memory) {}

Tools Used

vim

Recommended Mitigation Steps

• check the length of the two params and check for zero address too

       │ File: contracts/proxy/MIMOProxy.sol

 127   │   function multicall(address[] calldata targets, bytes[] calldata data) external override returns (byte
       │ s[] memory) {
  +          if(targets.length != data.length) {
  +              revert();
  +          } 
 128   │     if (msg.sender != owner) {
 129   │       revert CustomErrors.NOT_OWNER(owner, msg.sender);
 130   │     }
 131   │     bytes[] memory results = new bytes[](data.length);
 132   │     for (uint256 i = 0; i < targets.length; i++) {
  +            if (address(targets[i]) == address(0)) revert();
 133   │       (bool success, bytes memory response) = targets[i].call(data[i]);
 134   │       if (!success) {
 135   │         if (response.length > 0) {
 136   │           assembly {
 137   │             let returndata_size := mload(response)
 138   │             revert(add(32, response), returndata_size)
 139   │           }
 140   │         } else {
 141   │           revert CustomErrors.LOW_LEVEL_CALL_FAILED();
 142   │         }
 143   │       }
 144   │       results[i] = response;
 145   │     }
 146   │     return results;
 147   │   }
 148   │ }