Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Removing attester inside RegistryFactory.sol won't work for duplicate addresses

tamer

Summary

Calling the removeAttester() function inside of RegistryFactory.sol won't remove duplicate attesters.

Vulnerability Details

Since addAttester() does not have a mechanism to check if the address already exists and the only way to remove an attester is from removeAttester() removing them one by one will cost more resources than if you could remove them all at once.

Impact

You won't be able to remove duplicate attesters and you will need to make several transactions costing you more money.

Tools Used

Manual Review

Recommendations

Looping backwards because that way the array won't get re-indexed and we won't skip an attester.

function removeAttester(address attester) external onlyOwner {
+ for (uint256 i = attesters.length; i > 0; i--) {
- for (uint256 i = 0; i < attesters.length; i++) {
+ uint256 index = i - 1;
+ if (attesters[index] == attester) {
- if (attesters[i] == attester) {
+ attesters[index] = attesters[attesters.length - 1];
- attesters[i] = attesters[attesters.length - 1];
attesters.pop();
- break;
}
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Other
Assigned finding tags:

finding-ERC7848-add-duplicate-attester

Invalid, - Addition of attesters are admin only functionalities so if duplicate addresses are added it would consitute admin input/call validation. - ERC-7484 is in draft mode so we should not take it as the final EIP configuration yet. - Even if a mistake was made, removals can be performed by invoking `removeAttester` multiple times by the owner to completely remove a duplicate user. - In the [documentation](https://github.com/bcnmy/nexus/wiki#problems-nexus-solves), it is not noted that Nexus suite will be ERC7484 compliant.

Appeal created

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-ERC7484-sorted-duplicate-attestor-issue

Invalid, similar issue to #151 and duplicates - Addition of attesters are admin only functionalities so if duplicate addresses are added it would consitute admin input/call validation. - ERC-7484 is in draft mode so we should not take it as the final EIP configuration yet. - In the [documentation](https://github.com/bcnmy/nexus/wiki#problems-nexus-solves), it is not noted that Nexus suite will be ERC7484 compliant.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.