removeOracle Does Not Check If the Oracle Exists
Summary
The removeOracle function does not verify if the specified oracle exists before setting its status to false.
Vulnerability Details
Within the removeOracle function, there is no check to confirm whether the given oracle is currently active (i.e., approvedOracles[address(_oracleToRemove)] == true) before attempting to remove it. This results in the function blindly setting its status to false and emitting an event, even if the oracle was not approved in the first place.
Impact
The lack of verification can lead to unnecessary state changes and event emissions, potentially causing confusion or inefficiencies in the protocol's operation.
Tools Used
Manual Review
Recommendations
Add a validation step in removeOracle to ensure that approvedOracles[address(_oracleToRemove)] == true before modifying its state and emitting an event.
Lead Judging Commences
Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.