`UpdateWeightRunner::removeOracle` Does Not Verify Oracle Existence Before Emitting Event
Summary
The removeOracle function in the UpdateWeightRunner contract does not check if the specified oracle is already approved before proceeding to emit an event. As a result, the function emits the OracleRemoved event even when the oracle is not in the approved list.
Tools Used
Manual review
Recommendations
Add a check to ensure the oracle exists in the approvedOracles mapping before updating its status and emitting the event, similar to how the addOracle function performs validations.
Lead Judging Commences
Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.