Duplicate asset can be added

[code423n4]

Lines of code

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ManagedIndex.sol#L35
https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/TopNMarketCapIndex.sol#L57
https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/TrackedIndex.sol#L45

Vulnerability details

Impact

Initialize function can be called multiple times with same asset. Calling with same asset will make duplicate entries in assets list. Any function reading assets will get impacted and would retrieve duplicate asset

Proof of Concept

1. Observe that initialize function can be called multiple times
2. Admin calls initialize function with asset X
3. asset X gets added in assets object
4. Admin again calls initialize function with asset X
5. asset X again gets added in assets object making duplicate entries

Recommended Mitigation Steps

Add a check to fail if assets already contains the passed asset argument. Also add a modifier so that initialize could only be called once

require(!assets.contain(asset), "Asset already exists");

[jn-lp]

We require caller of initialize method to be a factory (which is non-upgradable contract), so it can't be called twice

see:

require(msg.sender == factory, "ManagedIndex: FORBIDDEN");

[moose-code]

Given the factory contract is not supplied it makes it impossible to know these things and hence siding with the warden for the disclosure.

" to be a factory (which is non-upgradable contract)" i.e. one can't know this if the factory is not supplied or documented.