Beginner FriendlyDeFiFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

Incorrect Dependency Indexing in laundrette::configureDependencies Leads to Overwritten Configuration

Summary

Dependency configuration is being overwritten in laundrette::configureDependencies by mistakenly using the same index for multiple dependencies. Specifically, the keycode of "MONEY" is overwritten by the keycode of "WEAPN".

Vulnerability Details

The assignment to dependencies[0] is overwritten, resulting in only "WEAPN" being added to dependencies, resulting in only "WEAPN" being added to dependencies, while "MONEY" is not included at all. This misindexing leads to the omission of the "MONEY" dependency, causing the critical configuration for "MONEY" to be lost.

Impact

The omission of the "MONEY" dependency due to misindexing results in the loss of critical information necessary for the laundrette contract to function correctly. This can lead to unexpected behavior or failure in parts of the contract that rely on the "MONEY" dependency.

Tools Used

Manual Review

Recommendations

Correct the indexing in the configureDependencies function to ensure that both dependencies are included.

function configureDependencies() external override onlyKernel returns (Keycode[] memory dependencies) {
dependencies = new Keycode[](2);
dependencies[0] = toKeycode("MONEY");
moneyShelf = MoneyShelf(getModuleAddress(toKeycode("MONEY")));
- dependencies[0] = toKeycode("WEAPN");
+ dependencies[1] = toKeycode("WEAPN");
weaponShelf = WeaponShelf(getModuleAddress(toKeycode("WEAPN")));
}
Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic
Assigned finding tags:

Laundrette incorrect dependencies

waydou Submitter
about 1 year ago
n0kto Lead Judge
about 1 year ago
n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Laundrette incorrect dependencies

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.