Submitted by Lambda, also found by enckrish
https://github.com/code-423n4/2022-08-olympus/blob/549b96bcf8b97807738572605f6b1e26b33ef411/src/Kernel.sol#L296
To check that an already active policy is not added a second time, isActive() is called on the policy. However, policy could be a malicious contract that always returns false for isActive(). In such a scenario, it would be possible to activate the policy multiple times for the same Kernel. This would break uniqueness invariants such that _deactivatePolicy() no longer works. However, it could also be used for a DoS attack: As _reconfigurePolicies and _migrateKernel iterate over those lists that now contain duplicates, they could run out of gas if a policy is activated enough times.
Check getPolicyIndex[policy_] != 0 instead of relying on a value of an untrusted contract.
0xLienid (Olympus) commented:
ind-igo (Olympus) commented:
0xean (judge) commented:
ind-igo (Olympus) commented:
