Cached Address can be changed by anyone

Summary

We cache an address if it is new in the mapping addressLookup. But it can be overwritten by anyone in the current case.

Vulnerability Detail

function _cacheAddress(address value) private {
        uint256 index = addressCache.length;
        addressCache.push(value);
        addressLookup[value] = index;

        emit AddressAddedToCache(value, index);
    }

Here, there is no check to ensure that the value is not already cached in another index. thus can be overwritten.

Impact

Result will be

addressLookup mapping will not work as intended. Hence if any external actors or protocols use this mapping as a source of truth , it will hamper them.

Code Snippet

https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial/contracts/multiinvoker/MultiInvokerRollup.sol#L201-L207

Tool used

Manual Review

Recommendation

Check that require addressLookup[value] ==(0) ;

sherlock-audit / 2023-05-perennial-judging

supernova - Cached Address can be changed by anyone #244