It is not possible to call RestrictionManager.updateMembers through the gateway and update multiple members at the same time

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/token/RestrictionManager.sol#L62-L67

Vulnerability details

Impact

When updating multiple members, centrifuge must send one massage for each member they want to update to the gateway and can not do the update at once

Proof of Concept

All massages that are send from centrifuge to the chain the protocol is deployed are send to the gateway. For a massage to be executed the function Gateway. handle() needs to recognize its messageType. Once the messageType is confirmed to be one of those that can be processed from the handle() function the relevant functions in other contracts are called. The problem is that there is no messageType that enables the handle() function to call RestrictionManager.updateMembers. This means that there is no way to update multiple members at the same time using the gateway.

Tools Used

Manual review

Recommended Mitigation Steps

Add a messageType to the enum Call in the massages library and the corresponding functions to the library to identify this messageTyps as well as format and parse messages for updateMembers. Also add an additional if statement to Gateway.handle() that processes this type of messages.

Assessed type

Other

[c4-pre-sort]

raymondfam marked the issue as low quality report

[c4-pre-sort]

raymondfam marked the issue as primary issue

[c4-pre-sort]

raymondfam marked the issue as duplicate of #29

[c4-judge]

gzeon-c4 marked the issue as unsatisfactory:
Invalid

[BenRai1]

@gzeon-c4 Can you elaborate why exactly this is invalid. Was not able to find anything that is suggesting the issue is invalid.

[c4-judge]

gzeon-c4 marked the issue as not a duplicate

[c4-judge]

gzeon-c4 removed the grade

[c4-judge]

gzeon-c4 changed the severity to QA (Quality Assurance)

[gzeon-c4]

valid QA, not breaking anything since the singular updateMember is still available @hieronx

[c4-sponsor]

hieronx (sponsor) acknowledged

[hieronx]

valid QA, not breaking anything since the singular updateMember is still available

Agreed 👍