Submitted by Lambda, also found by Respx and Ruhum
AxelarGateway.sol#L268
AxelarGateway.sol#L311
According to the specifications, only the current operators should be able to transfer operatorship. However, there is one way to circumvent this. Because currentOperators is not updated in the loop, when multiple transferOperatorship commands are submitted in the same execute call, all will succeed. After the first one, the operators that signed these commands are no longer the current operators, but the call will still succeed.
This also means that one set of operators could submit so many transferOperatorship commands in one execute call that OLD_KEY_RETENTION is reached for all other ones, meaning they would control complete set of currently valid operators.
Set currentOperators to false when the operators were changed.
re1ro (Axelar) confirmed, but disagreed with severity and commented:
milapsheth (Axelar) commented:
Alex the Entreprenerd (judge) commented:
Alex the Entreprenerd (judge) commented:
