RootPort.addBridgeAgentFactory() is taking bridgeAgentLenght into account rather than bridgeAgentFactoriesLength

[code423n4]

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/cfed0dfa3bebdac0993b1b42239b4944eb0b196c/src/ulysses-omnichain/RootPort.sol#L405-L411

Vulnerability details

Impact

• This function will increase bridgeAgentsLenght rather than bridgeAgentFactoriesLenght which will lead to improper state update in bridgeAgentFactories[] array.

• Also it will lead to improper state change in bridgeAgents[] as bridgeAgentsLenght is changed unexpectedly.

• This can have severe impact while traversing and fetching addresses from both arrays.

Proof of Concept

https://github.com/code-423n4/2023-05-maia/blob/cfed0dfa3bebdac0993b1b42239b4944eb0b196c/src/ulysses-omnichain/RootPort.sol#L405-L411

Tools Used

Manual Review

Recommended Mitigation Steps

• Remove bridgeAgentsLenght and add bridgeAgentFactoriesLenght instead in the function.

Assessed type

Error

[c4-judge]

trust1995 marked the issue as duplicate of #372

[c4-judge]

trust1995 marked the issue as satisfactory

[c4-judge]

trust1995 changed the severity to 2 (Med Risk)

[c4-judge]

trust1995 marked the issue as partial-50