Submission Details
Severity:
The same shop partner can be added twice in `KittyConnect:addShop()`
Severity
Impact: Medium, since a "bad" shop partner can be allowed twice
Likelihood: Low, since only authorized user can perform such activity
Description
KittyConnect:addShop() allows an admin to register a new shop partner in the KittyConnect protocol.
However, this function, doesn't check if a shop partner is already allowed before pushing it in the array of allowed partners.
function addShop(address shopAddress) external onlyKittyConnectOwner {
s_isKittyShop[shopAddress] = true;
s_kittyShops.push(shopAddress);
emit ShopPartnerAdded(shopAddress);
}
Recommendations
Change the function like this:
function addShop(address shopAddress) external onlyKittyConnectOwner {
+ if (s_isKittyShop[shopAddress])
+ revert KittyConnect__ShopAlreadyRegistered();
s_isKittyShop[shopAddress] = true;
s_kittyShops.push(shopAddress);
emit ShopPartnerAdded(shopAddress);
}
Rewards breakdown
nSLOC
235This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.