code423n4 commented 2 years ago

Lines of code

Vulnerability details

DexManagerFacet.batchRemoveDex is used to remove many DEXs in the same transaction. However, the return in L73, will push the function to return directly after removing the first DEX in the _dexs list. So the actual implementation will just remove the first element in the list, which could be a serious problem as the contract owner could think that he removes an access to a DEXs while he doesn't. I put this as high because this affects the ACCESS CONTROL.
Recommendation: remove the return (as simple as that).

H3xept commented 2 years ago

Duplicate of #34

gzeoneth commented 2 years ago

Changing to Med Risk to align with #34