Array index out of bounds can go in function removeOperator in NestedFactory.sol

[code423n4]

Handle

fatima_naz

Vulnerability details

Impact

In function removeOperator -
function removeOperator(bytes32 operator) external override onlyOwner {
uint256 i = 0;
while (operators[i] != operator) {
i++;
}
require(i > 0, "NestedFactory::removeOperator: Cant remove non-existent operator");
delete operators[i];
}

In the while condition it is not checked that i<operators.length so if the required operator does not exist in the array then the condition operators[i] != operator will always be true and variable i will always increase. So once it is equal to the length of array it will try to access that index but that index is out of bound to it will throw an exception.

Proof of Concept

TokenMarketNet/smart-contracts#101
https://jeancvllr.medium.com/solidity-tutorial-all-about-array-efdff4613694

Tools Used

Recommended Mitigation Steps

we need to add a check in while loop that i<operators.length

[maximebrugel]

Duplicated : #58

[alcueca]

Duplicate of #59

[alcueca]

Actually, taking #220