requireNextActiveMultisig() FUNCTION RETURNS ALWAYS THE ADDRESS OF THE FIRST ENABLE MULTISIG

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/MultisigManager.sol#L80-L91
https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/MinipoolManager.sol#L236

Vulnerability details

MultisigManager.sol function requireNextActiveMultisig() will always return the first enabled multisig address instead of the next one.

Impact

Only the first registered multisig address is always assigned to a pool, making the rest of the registered multisig addresses useless. And therefore less decentralized.

Proof of Concept

https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/MinipoolManager.sol#L236
createMinipool() function on MiniPoolManager.sol calls multisigManager.requireNextActiveMultisig() to assign a new multisig to the current pool.

https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/MultisigManager.sol#L80-L91
But the requireNextActiveMultisig() function on MultisigManager.sol always returns the first enabled multisig address, as it traverses all multisigs by index from 0 to count and returns the first enabled one instead of the next one:

for (uint256 i = 0; i < total; i++) {
			(addr, enabled) = getMultisig(i);
			if (enabled) {
				return addr;
			}
		}

Tools Used

vscode, Foundry

Recommended Mitigation Steps

If the protocol intends to get the next multisig address as the function name requireNextActiveMultisig() says, a good fix would be to keep track of the last assigned multisig address on MinipoolManager and start traversing all multi sig from that index instead of from position 0.

[c4-judge]

GalloDaSballo marked the issue as duplicate of #702

[c4-judge]

GalloDaSballo marked the issue as satisfactory

[c4-judge]

GalloDaSballo changed the severity to 2 (Med Risk)