Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inability of ArchController to enable disabled hookstemplate #82

Closed
howlbot-integration bot opened this issue Sep 20, 2024 · 1 comment
Closed
Labels
bug Something isn't working downgraded by judge Judge downgraded the risk level of this issue duplicate-50 edited-by-warden grade-b QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax 🤖_11_group AI based duplicate group recommendation sufficient quality report This report is of sufficient quality

Comments

@howlbot-integration
Copy link

Lines of code

https://github.com/code-423n4/2024-08-wildcat/blob/fe746cc0fbedc4447a981a50e6ba4c95f98b9fe1/src/HooksFactory.sol#L201-L208
https://github.com/code-423n4/2024-08-wildcat/blob/fe746cc0fbedc4447a981a50e6ba4c95f98b9fe1/src/HooksFactory.sol#L297-L299

Vulnerability details

Proof of Concept

In the current implementation of the Hookfactory contract ArchController , the owner can disable hook templates using the disableHooksTemplate() function, but there is no method provided to re-enable previously disabled hooks. This can create operational inefficiencies, forcing the owner to create new hook templates whenever they need to re-enable a previously disabled one.

Relevant Code Snippet:
The current function only allows disabling hook templates:

function disableHooksTemplate(address hooksTemplate) external override onlyArchControllerOwner { 
    if (!_templateDetails[hooksTemplate].exists) {
        revert HooksTemplateNotFound();
    }
    _templateDetails[hooksTemplate].enabled = false;
    emit HooksTemplateDisabled(hooksTemplate);
}

Referencing the last audit- code-423n4/2023-10-wildcat-findings#431.
A function to reenable disabled hooks should be created.

Recommended Mitigation Steps

To resolve this, the ArchController should include a function to enable previously disabled hook templates. Below is a recommended implementation for the enableHooksTemplate() function.

function enableHooksTemplate(address hooksTemplate) external override onlyArchControllerOwner {
    // Check if the template exists
    if (!_templateDetails[hooksTemplate].exists) {
        revert HooksTemplateNotFound();
    }

    // Check if the template is already enabled
    if (_templateDetails[hooksTemplate].enabled) {
        revert HooksTemplateAlreadyEnabled();
    }

    // Enable the hooks template
    _templateDetails[hooksTemplate].enabled = true;

    // Emit an event to indicate that the template has been enabled again
    emit HooksTemplateEnabled(hooksTemplate);
}






## Assessed type

Error
@howlbot-integration howlbot-integration bot added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value 🤖_11_group AI based duplicate group recommendation bug Something isn't working duplicate-50 edited-by-warden sufficient quality report This report is of sufficient quality labels Sep 20, 2024
howlbot-integration bot added a commit that referenced this issue Sep 20, 2024
@c4-judge
Copy link
Contributor

c4-judge commented Oct 3, 2024

3docSec changed the severity to QA (Quality Assurance)

@c4-judge c4-judge added downgraded by judge Judge downgraded the risk level of this issue QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax and removed 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value labels Oct 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working downgraded by judge Judge downgraded the risk level of this issue duplicate-50 edited-by-warden grade-b QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax 🤖_11_group AI based duplicate group recommendation sufficient quality report This report is of sufficient quality
Projects
None yet
Development

No branches or pull requests

2 participants