NestedFactory cannot remove 0th operator from operators array

[code423n4]

Handle

elprofesor

Vulnerability details

Impact

NestedFactory implements inappropriate validation preventing the removal of 0th index operator in operators array. This prevents the removal of any malicious or compromised operators which compromises could potentially break other functions within the NestedFactory contract.

Proof of Concept

Details listed above can be seen in the following:

require(i > 0, "NestedFactory::removeOperator: Cant remove non-existent operator"); // @audit - LOW: can't remove 0'th element operator
        delete operators[i]; 

click here for link to git repo

Recommended Mitigation Steps

An example of more accurate removal process can be seen below:

/// @inheritdoc INestedFactory
function removeOperator(bytes32 operator) external override onlyOwner {
    uint256 i = 0;
    for (uint index=0 ; index < operators.length ; index++) {
        if(operators[i] == operator) i = index
    }
    require(i > 0, "NestedFactory::removeOperator: Cant remove non-existent operator");
    delete operators[i];
}

[maximebrugel]

Duplicated : #58

[alcueca]

Using #220 instead