097.md

Sparkly Seaweed Wolf

Medium

Profile's max addresses cannot work as expected if we repeat register, unregister one address in one profile

Summary

In EthosProfile::registerAddress, we miss updating profiles[profileId].removedAddresses. This will cause maxNumberOfAddresses limitation cannot work well.

Root Cause

In EthosProfile:373, users can register one address into one active profile. There are two basic scenario for registerAddress():

1. Register one fresh address into one profile
2. Register one deleted address back to our profile. Use case: user can register, unregister and register again the same address. The problem is that when we try to register one deleted address back to our profile, we miss delete this address from profiles[profileId].removedAddresses. This will cause this registered address will be in profiles[profileId].addresses and profiles[profileId].removedAddresses at the same time. This will cause the number of this profile's addresses cannot reach maxNumberOfAddresses.

  function registerAddress(
    address addressStr,
    uint256 profileId,
    uint256 randValue,
    bytes calldata signature
  ) external whenNotPaused onlyNonZeroAddress(addressStr) {
    ...
    profiles[profileId].addresses.push(addressStr);
    profileIdByAddress[addressStr] = profileId;
    checkMaxAddresses(profileId);
  }
  function checkMaxAddresses(uint256 profileId) internal view {
    uint256 sum = profiles[profileId].addresses.length;
    sum += profiles[profileId].removedAddresses.length;
    if (sum > maxNumberOfAddresses) {
      revert MaxAddressesReached(profileId);
    }
  }

Internal pre-conditions

1. One address is deleted and re-registered by the profile owner.

External pre-conditions

N/A

Attack Path

1. One address is deleted and re-registered into the profile.
2. When the user wants to register his last address in maxNumberOfAddresses, the register will be reverted.

Impact

Users' maximum address may be lower than maxNumberOfAddresses. This is unexpected behaviour, and break the design intent.

PoC

N/A

Mitigation

When we register one address, if this address exists in the profiles[profileId].removedAddresses list, we should remove this address from the profiles[profileId].removedAddresses.