OlaHamid - [H-2] Local var `numFacet` in the `DiamondLoupFacet.sol:facets` function is set to zero, desrupting the total logic of the code.

[sherlock-admin4]

OlaHamid

High

[H-2] Local var numFacet in the DiamondLoupFacet.sol:facets function is set to zero, desrupting the total logic of the code.

Summary

Description: Identified a vulnerability in the facets function where the variable numFacets is initialized to zero but is subsequently used in loop logic. This leads to the function logic being disrupted and not functioning as intended.

Root Cause

local variable numFacets in the DiamondLoupFacet.sol:facets function set to zero.

Internal pre-conditions

Internal Pre-conditions for DiamondLoupFacet.sol:facets Vulnerability

1. Developer needs to initialize numFacets to zero in the facets function.
2. Function logic relies on numFacets for loop execution.
3. No proper assignment to numFacets before it is used in the loop condition.

Example:

• Developer needs to initialize numFacets to zero in the facets function.
• Function logic relies on numFacets for loop execution.
• No proper assignment to numFacets before it is used in the loop condition.

External pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

Proof of Concept: The vulnerability arises because numFacets is set to zero initially and is used in a loop condition. Without proper initialization or assignment, the loops relying on numFacets fail to execute correctly, breaking the function’s intended logic.

    uint256 numFacets; // Initialized to zero
// Further code relies on numFacets
for (uint256 facetIndex = 0; facetIndex < numFacets; facetIndex++) {
    // Loop logic
}

Mitigation

Recommended Mitigation:

    function facets() external view override returns (Facet[] memory facets_) {
        LibDiamond.DiamondStorage storage ds = LibDiamond.diamondStorage();
        uint256 selectorCount = ds.selectors.length;
        // create an array set to the maximum size possible
                    facets_ = new Facet[](selectorCount);
        // create an array for counting the number of selectors for each facet
        uint8[] memory numFacetSelectors = new uint8[](selectorCount);
        // total number of facets
        // @audit numFacets not initialised, breaks the current function
        // @mitigation creaate a numFacet to be equal to facets_.length 
-       uint256 numFacets;  
+       uint256 numFacets = facets_.length; // Properly initialize numFacets