code-423n4 / 2021-10-covalent-findings

0 stars 0 forks source link

Function `addValidator()` is missing check if validator exists already #69

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

pmerkleplant

Vulnerability details

Impact

The function addValidator() does not check if the validator was present already. This maybe does not introduce security issues, but forfeits code clarity as the function addValidator() can also be used to update a validator's entry.

See line 345

kitti-katy commented 3 years ago

can't update validator's entry since validatorsN determines new validatorId. And gets incremented.

GalloDaSballo commented 3 years ago

As per the sponsor's comment, the finding is not considering that the ids are sequential

Marking as invalid