search

sherlock-audit / 2024-10-ethos-network-judging

0 stars 0 forks source link

Jovial Tan Donkey - Wrong storage of removed addresses in EthosProfile causes confusion. #334

Closed sherlock-admin4 closed 2 weeks ago

sherlock-admin4 commented 2 weeks ago

Jovial Tan Donkey

Low/Info

Wrong storage of removed addresses in EthosProfile causes confusion.

Summary

When deleting a registered address from a profile via deleteAddressAtIndex(), the function calls _deleteAddressAtIndexFromArray() to update the mappings in storage.

This function push the last address of the array 'addresses[]' into removedAddresses[] instead of the removing address.

the removedAddresses[] is **removedAddresses**: (address[]) An array of addresses that were previously associated with the profile but have since been removed. as stated in EthosProfile.md

Root Cause

The functions correctly updates the mappings but push the wrong address into the 'removedAddress[]'. Line 591

    address addr = addresses[addresses.length - 1];
    addresses[index] = addr;
@>  removedAddresses.push(addr);

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

This will cause users or other protocols to wrongly think an address associated with a profile is no longer associated.

PoC

No response

Mitigation

No response

sherlock-admin2 commented 2 weeks ago

The protocol team fixed this issue in the following PRs/commits: https://github.com/trust-ethos/ethos/pull/1836