Defender may not be able to call disableAllMultisigs

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/Ocyticus.sol#L55-L66

Vulnerability details

Impact

Ocyticus only have a disableAllMultisigs function, which may revert if the count is too large (due to out of gas). Although the multisig set is currently limited to 10, it might change in the future and there are no clear documentation that the Ocyticus would also need to be redesigned.

https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/MultisigManager.sol#L79

	/// @dev There will never be more than 10 total multisigs. If we grow beyond that we will redesign this contract.

Proof of Concept

https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/Ocyticus.sol#L55-L66

	function disableAllMultisigs() public onlyDefender {
		MultisigManager mm = MultisigManager(getContractAddress("MultisigManager"));
		uint256 count = mm.getCount();

		address addr;
		bool enabled;
		for (uint256 i = 0; i < count; i++) {
			(addr, enabled) = mm.getMultisig(i);
			if (enabled) {
				mm.disableMultisig(addr);
			}
		}

Recommended Mitigation Steps

Allow Ocyticus to disable individual multisig

[GalloDaSballo]

Because of clearly defined settings I think this will be invalid, but will flag to Sponsor

[0xju1ie]

I think if we add #521 then we would have to add this one too but not sure

But as the protocol currently sits I would think this is invalid or QA at best

[GalloDaSballo]

Per the sponsor's comment, I think the finding is a QA report

L

[c4-judge]

GalloDaSballo changed the severity to QA (Quality Assurance)

[c4-judge]

GalloDaSballo marked the issue as grade-c