First Flight #16: Mafia Takedown

Summary

In the Laundrette::configureDependencies, in an array it sets up all the keycodes of modules, at idx 0 it assigns MONEY keycode but again at the same idx 0 it assigns the WEAPN keycode, which will lead to problems during migrations.

Vulnerability Details

The vulnerability is present in the Laundrette::configureDependencies function where it first assigns MONEY keycode at idx 0, and then WEAPN keycode at that same idx, as a result of which configureDependencies returns only the WEAPN keycode to the kernel while activating the policy, due to which the moduleDependents data structure is not updated with the policy that corresponds to the MONEY keycode.

Impact

The impact of this vulnerability happens during migration of the money shelf module to the money vault, when the executor calls the executeAction function for upgrading money shelf module to money vault then it invokes _upgradeModule function which involves getting all the policies that belongs to the keycode of the module being upgraded via moduleDependents but as the moduleDependents was not updated leads to no reconfiguring of module in the policy contract as a result of which it still points to the old money shelf contract.

PoC

Add the test in the file: test/EmergencyMigration.t.sol

Run the test:

Tools Used

Manual Review, Unit Test in Foundry

Recommendations

Update the dependencies array in Laundrette::configureDependencies to assign WEAPN keycode at idx 1

Now again run the above discussed tests and they fails which means the Laundrette policy is reconfigured.