Summary

Laundrette::configureDependencies incorrectly uses the same index for two different dependencies, causing the first dependency to be overwritten. This results in only one dependency being recorded, which can lead to improper configuration and potential malfunction of the contract.

Vulnerability Details

Laundrette::configureDependencies is designed to set up the dependencies for the Laundrette contract. However, it uses the same index (dependencies[0]) for both MONEY and WEAPN dependencies, causing the first dependency to be overwritten by the second. The relevant code is as follows:

Impact

This vulnerability leads to only one dependency being recorded instead of two, which results in improper configuration of the protocol, where the Laundrette contract may not properly configure its dependencies and the protocol's overall access control.

Tools Used

Manual code review

Recommendations

To resolve this issue, the Laundrette::configureDependencies function should be corrected to use separate indexes for each dependency. Here is the updated implementation: