Chandr - addPlugin() shold check, that added contract is plugin

[sherlock-admin]

Chandr

medium

addPlugin() shold check, that added contract is plugin

Summary

If you add an address that is not a plugin with addPlugin(), then the user will not be able to use the stake() function, even if a valid contract with the plugin has been added before

Vulnerability Detail

1) add valid plugin(simple plugin) to module contract 2) add not valid plugin(address(0x42)) to module contract 3) Try to stake

Impact

Expected behaivor: User can stake to valid plugin, even though there is an invalid plugin in the list of plugins

Real behaivor: Transer reverted with: "EvmError: Revert"

Impact

User cannot deposit funds to stake

Code Snippet

function addPlugin(address plugin) external onlyRole(PLUGIN_EDITOR_ROLE) {
        require(!pluginsMapping[plugin], "StakingModule::addPlugin: Cannot add an existing plugin");

        plugins.push(plugin);
        pluginsMapping[plugin] = true;
        nPlugins++;

        emit PluginAdded(plugin, nPlugins);
    }

Tool used

Manual Review

Recommendation

Add a check when adding a plugin that the plugin is a valid contract

Duplicate of #69