XDZIBEC - XO- `revokeLPTransferors` function prevent users from `transferring LP tokens`

[sherlock-admin]

XDZIBEC

medium

XO- revokeLPTransferors function prevent users from transferring LP tokens

Summary

• The vulnerability can loop to delete elements from the allowances_ mapping that it should not delete. This could lead to incorrect behavior in the contract.

  Vulnerability Detail

  function revokeLPTransferors(
      mapping(address => bool) storage allowances_,
      address[] calldata transferors_
  ) external  {
      uint256 transferorsLength = transferors_.length;
      for (uint256 i = 0; i < transferorsLength; ) {
          delete allowances_[transferors_[i]];
  
          unchecked { ++i; }
      }
  
      emit RevokeLPTransferors(
          msg.sender,
          transferors_
      );
  }

• this delete allowances_[transferors_[i]]; make a problem that line will delete the the transferors_[i] element from the allowances_ mapping, but it will not update the i index. so that the next time the loop is gone to iterates, it will try to delete the element at index i + 1, which may not exist.

  Impact

• the vulnerability can cause the loop to delete elements from the allowances_ mapping that it should not delete.

  Code Snippet

• https://github.com/sherlock-audit/2023-04-ajna/blob/main/ajna-core/src/libraries/external/LPActions.sol#L180C3-L197C1

  Tool used

Manual Review

Recommendation

• it's should update the i index after deleting the element from the allowances_ mapping.