https://github.com/code-423n4/2022-07-fractional/blob/8f2697ae727c60c93ea47276f8fa128369abfe51/src/Vault.sol#L73
The Vault.install function sets the 4 bytes function selector as the index of the methods mapping.
If there are two plugins with the same function name and parameter types, the second plugin will overwrite the first plugin.
https://github.com/code-423n4/2022-07-fractional/blob/8f2697ae727c60c93ea47276f8fa128369abfe51/src/Vault.sol#L73
Assume that the following two plugins and their function need to be installed:
Therefore, _selectors array will be [a9059cbb, a9059cbb], and _plugins array will be [ABC, XYZ].
Passing the above _selectors and _plugins arrays into the Vault.install function will cause the ABC.transfer(address,uint256) function to be overwritten by XYZ.transfer(address,uint256).
When calling methods[a9059cbb], it will only return the second plugin which is XYZ contract. Thus, ABC.transfer(address,uint256) will not be callable within the vault.
This might potentially cause the asset to be stuck in the vault or cause key functionalities within the vault to be unusable due to missing plugin functions.
It is recommended to revert the Vault.install transaction if the callers attempt to install two plugins with the same function selector so that they are aware of this overwriting issue. Additional comments can be added to warn the caller about this issue or inform the caller that all function selectors must be unique across all plugins.
Consider implementing the following validation check so that plugins function will not be accidentally overwritten.
