Submission Details
Severity:
initializables and initializePayloads can have different length in "initializeRootUpgrade"
Summary
There is no check for array length check in initializables and initializePayloads.
Vulnerability Details
https://github.com/Cyfrin/2024-07-zaros/blob/main/src/tree-proxy/leaves/RootUpgrade.sol#L213
function initializeRootUpgrade(
RootProxy.BranchUpgrade[] memory,
address[] memory initializables,
bytes[] memory initializePayloads
)
internal
{
@> for (uint256 i; i < initializables.length; i++) {
address initializable = initializables[i];
bytes memory data = initializePayloads[i];
if (initializable.code.length == 0) {
revert Errors.InitializableIsNotContract(initializable);
}
Address.functionDelegateCall(initializable, data);
}
}
}
Impact
functionDelegateCall calls will be wrong.
Tools Used
Recommendations
require(initializables.length()==initializePayloads.length());
Updates
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,87821 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.