First Flight #16: Mafia Takedown

Summary

A vulnerability was discovered in the configureDependencies function of the Laundrette smart contract, where an incorrect assignment in the dependencies array can lead to malfunctioning of the contract's operations.

Vulnerability Details

The configureDependencies function is responsible for setting up the dependencies for the Laundrette contract by initializing the moneyShelf and weaponShelf variables. The function constructs an array of Keycode type called dependencies to store the keycodes of the required modules.

The code intends to set two different keycodes for moneyShelf and weaponShelf modules. However, there is an error in the assignment:

The correct assignment should be:

Impact

This misconfiguration can lead to the following issues:

1. Only one keycode (toKeycode("WEAPN")) is stored in the dependencies array, overwriting the previously set keycode (toKeycode("MONEY")).

2. The moneyShelf module will not be correctly registered as a dependency, potentially causing the contract to fail when it attempts to interact with the moneyShelf functions.

3. Any functionality relying on the moneyShelf module will be disrupted, leading to a partial or complete failure of the contract's intended operations.

Tools Used

Manual code review

Recommendations

To resolve this vulnerability, the following changes should be made in the configureDependencies function:

Correct the index assignment for the second dependency:

The corrected function should be:

Implementing these changes will ensure that both the moneyShelf and weaponShelf dependencies are correctly registered, maintaining the integrity and functionality of the Laundrette contract.