Submitted by enckrish
There are no checks to ascertain that the policy being removed is registered in the Kernel. Trying to remove a non-registered results in the policy registered at 0th index of activePolicies being removed.
https://github.com/code-423n4/2022-08-olympus/blob/main/src/Kernel.sol#L325
Adding require(activePolicies[idx] == policy_, "Unregistered policy"); will prevent this, where idx = getPolicyIndex[policy_].
NOTE: The issue is less likely to happen as this is handled solely by the executor, but having safeguards in the contract is always better than relying on an external factor.
ind-igo (Olympus) confirmed, but disagreed with severity and commented:
0xean (judge) commented:
Oighty (Olympus) commented:
0xean (judge) commented:
