Summary

The quitTheGang should only allow the caller gang member to quit the gang but a gang member can pass any other gang member's address and remove them from the gang.

Vulnerability Details

• The vulnerability is present in the quitTheGang function where it is meant for a particular gang member to quit. But instead it allows a gang member to remove any other gang member from their gang.

• The gang member doesn't have the privilege to remove any other gang member except self, but still they are allowed to remove other members from the gang.

Impact

Allows a gang member to remove any gang members.

Tools Used

Manual Review

Recommendations

Instead of taking account as argument from the gang member, use msg.sender as the account so that only the caller is quitting.