Submitted by hakunamatata, also found by 056Security, 0xkrodhan, 0xShitgem, and HaidutiSec
https://github.com/code-423n4/2025-03-nudgexyz/blob/main/src/campaign/NudgeCampaign.sol#L164-L233
https://github.com/code-423n4/2025-03-nudgexyz/blob/main/src/campaign/NudgePointsCampaigns.sol#L126-L178
https://github.com/code-423n4/2025-03-nudgexyz/blob/main/src/campaign/NudgeCampaignFactory.sol#L4
Li.Fis Executor contract is granted SWAP_CALLER_ROLE. The function handleReallocation is used inside the protocol to notify about users reallocation and can only be called by address that has SWAP_CALLER_ROLE. The intention of the protocol is to use the executors functions so that executor swaps assets and then calls handleReallocation inside NudgeCampaign / NudgePointsCampaign contract.
However, the Executor contract that has as a SWAP_CALLER_ROLE can be used by anyone (its functions do not have access control restrictions which is expected), anyone can call function swapAndExecute. This means that any user can call the swapAndExecute function and instruct the Executor to call arbitrary functions on other contracts.
As a result, an attacker can use the Executor to call renounceRole on the NudgeCampaignFactory contract, causing the Executor to lose its SWAP_CALLER_ROLE. This leads to DOS of every next handleReallocation call from Executor. Admin has to grantRole again to Executor contract, but user can repeat the process of renouncingRole using Executor. 
Executor function that can be called is here.
In order to POC to work, we must copy and paste contracts related to Executor and ERC20Proxy (the contract used by Executor) from official Li Fis contract repository so that we can use Executor inside our tests.
Ive put LiFis contracts inside campaign directory in new folders created by me; Errors, Helpers, Interfaces, Libraries and Periphery:
Disallow Executor to renounce their role, or store executor as address and only verify that msg.sender is executor; which would make it impossible to renounce the role from the executor.
raphael (Nudge.xyz) confirmed
