'delete session.blockProperties[agreedBlockHash]' in BlockSpecimenProofChain._finalizeWithParticipants which contains a mapping
Summary
The smart contract 'BlockSpecimenProofChain' contains a vulnerability related to the deletion of a mapping element in the '_finalizeWithParticipants' function. The function deletes an element in the 'session.blockProperties' mapping, which contains a structure. This may lead to gas estimation inaccuracies, potential security risks, and unexpected behavior in the contract
Vulnerability Detail
The '_finalizeWithParticipants' function deletes a mapping 'session.blockProperties' element using 'delete session.blockProperties[agreedBlockHash]'. Deletion on a mapping containing a structure don't remove map data,the remaining data may be used to compromise the contract.
Impact
The remaining data may be used to compromise the contract.
iberry
medium
'delete session.blockProperties[agreedBlockHash]' in BlockSpecimenProofChain._finalizeWithParticipants which contains a mapping
Summary
The smart contract 'BlockSpecimenProofChain' contains a vulnerability related to the deletion of a mapping element in the '_finalizeWithParticipants' function. The function deletes an element in the 'session.blockProperties' mapping, which contains a structure. This may lead to gas estimation inaccuracies, potential security risks, and unexpected behavior in the contract
Vulnerability Detail
The '_finalizeWithParticipants' function deletes a mapping 'session.blockProperties' element using 'delete session.blockProperties[agreedBlockHash]'. Deletion on a mapping containing a structure don't remove map data,the remaining data may be used to compromise the contract.
Impact
The remaining data may be used to compromise the contract.
Code Snippet
https://github.com/sherlock-audit/2023-11-covalent/blob/main/cqt-staking/contracts/BlockSpecimenProofChain.sol#L441-L463
https://github.com/sherlock-audit/2023-11-covalent/blob/main/cqt-staking/contracts/BlockSpecimenProofChain.sol#L462
Tool used
Manual Review
Recommendation
clear data participants in before delete session.blockProperties[agreedBlockHash]
Duplicate of #33