{"componentChunkName":"component---node-modules-rocketseat-gatsby-theme-docs-core-src-templates-docs-query-js","path":"/manual-review/RulesEngine-REE","result":{"data":{"mdx":{"id":"7a132383-fcf1-54b9-9304-205ddf754624","excerpt":"REE-01M: Inexistent Truncation of Active ID Array Type Severity Location Logical Fault RulesEngine.sol:L326 Description: The  RulesEngine…","fields":{"slug":"/manual-review/RulesEngine-REE/"},"frontmatter":{"title":"RulesEngine Manual Review Findings","description":"Contains all the findings that relate to manual review on the contract codebase","image":null,"disableTableOfContents":null},"body":"var _excluded = [\"components\"];\n\nfunction _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsxRuntime classic */\n\n/* @jsx mdx */\nvar _frontmatter = {\n  \"title\": \"RulesEngine Manual Review Findings\",\n  \"description\": \"Contains all the findings that relate to manual review on the contract codebase\"\n};\nvar layoutProps = {\n  _frontmatter: _frontmatter\n};\nvar MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  var components = _ref.components,\n      props = _objectWithoutProperties(_ref, _excluded);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"h2\", {\n    \"id\": \"span-idree-01mree-01m-inexistent-truncation-of-active-id-arrayspan\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h2\",\n    \"href\": \"#span-idree-01mree-01m-inexistent-truncation-of-active-id-arrayspan\",\n    \"aria-label\": \"span idree 01mree 01m inexistent truncation of active id arrayspan permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), mdx(\"span\", {\n    id: \"REE-01M\"\n  }, \"REE-01M: Inexistent Truncation of Active ID Array\")), mdx(\"table\", null, mdx(\"thead\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"thead\"\n  }, mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Type\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Severity\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Location\"))), mdx(\"tbody\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/sova-network-fountfi-protocol-684adfa36579f5001821a219/appendix/finding-types#logical-fault\"\n  }, \"Logical Fault\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-minor\",\n    \"src\": \"https://omniscia.io/report-assets/minor.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/hooks/RulesEngine.sol#L326\"\n  }, \"RulesEngine.sol:L326\"))))), mdx(\"h3\", {\n    \"id\": \"description\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#description\",\n    \"aria-label\": \"description permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Description:\"), mdx(\"p\", null, \"The \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/hooks/RulesEngine.sol#L291-L327\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"RulesEngine::_getSortedActiveHookIds\")), \" function will yield a \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"sortedActiveIds\"), \" array that is filled with zero-value entries in place of any inactive hook IDs.\"), mdx(\"p\", null, \"This can result in significant misbehaviours should a hook ID of \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"0\"), \" be registered in the system.\"), mdx(\"h3\", {\n    \"id\": \"impact\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#impact\",\n    \"aria-label\": \"impact permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Impact:\"), mdx(\"p\", null, \"If a hook ID of zero is registered in the system that is active, the sub hook evaluation mechanism would repetitively invoke it incorrectly.\"), mdx(\"h3\", {\n    \"id\": \"example\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#example\",\n    \"aria-label\": \"example permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Example:\"), mdx(\"pre\", null, mdx(\"code\", {\n    parentName: \"pre\",\n    \"className\": \"language-sol\",\n    \"metastring\": \"title=src/hooks/RulesEngine.sol highlight={4,9,10,11,12,36} lineNumbers=true lineOffset=290\",\n    \"title\": \"src/hooks/RulesEngine.sol\",\n    \"highlight\": \"{4,9,10,11,12,36}\",\n    \"lineNumbers\": \"true\",\n    \"lineOffset\": \"290\"\n  }, \"function _getSortedActiveHookIds() private view returns (bytes32[] memory) {\\n    uint256 activeHooksCount = 0;\\n    uint256 numHooks = _hookIds.length;\\n    bytes32[] memory sortedActiveIds = new bytes32[](numHooks);\\n    uint256 currentIndex = 0;\\n\\n    // Count active hooks\\n    for (uint256 i = 0; i < numHooks;) {\\n        if (_hooks[_hookIds[i]].active) {\\n            activeHooksCount++;\\n            sortedActiveIds[currentIndex++] = _hookIds[i];\\n        }\\n\\n        unchecked {\\n            ++i;\\n        }\\n    }\\n\\n    // Simple insertion sort by priority on the active hooks\\n    for (uint256 i = 1; i < activeHooksCount;) {\\n        bytes32 key = sortedActiveIds[i];\\n        uint256 keyPriority = _hooks[key].priority;\\n        uint256 j = i;\\n\\n        while (j > 0 && _hooks[sortedActiveIds[j - 1]].priority > keyPriority) {\\n            sortedActiveIds[j] = sortedActiveIds[j - 1];\\n            j--;\\n        }\\n        sortedActiveIds[j] = key;\\n\\n        unchecked {\\n            ++i;\\n        }\\n    }\\n\\n    return sortedActiveIds;\\n}\\n\")), mdx(\"h3\", {\n    \"id\": \"recommendation\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#recommendation\",\n    \"aria-label\": \"recommendation permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Recommendation:\"), mdx(\"p\", null, \"We advise the code to instead truncate the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"sortedActiveIds\"), \" to the desired array length by utilizing a direct \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"mstore\"), \" operation via \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"assembly\"), \"; a practice that is confirmed to be safe as it reduces rather than increases the memory space the function uses whilst the compiler assumes that the relevant memory bytes are in use.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-e4d6885477438291b0d3ca477fab7e088522967b\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-e4d6885477438291b0d3ca477fab7e088522967b\",\n    \"aria-label\": \"alleviation e4d6885477438291b0d3ca477fab7e088522967b permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (e4d6885477438291b0d3ca477fab7e088522967b):\"), mdx(\"p\", null, \"The code was updated to properly truncate the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"sortedActiveIds\"), \" array length, optimizing the code' gas cost significantly and addressing the edge case outlined in the exhibit.\"), mdx(ViewDiffButton, {\n    repoUrl: \"https://github.com/SovaNetwork/fountfi\",\n    mainHash: \"fca2fe922e699e8762410f40e249961b53c3bf92\",\n    fixHash: \"e4d6885477438291b0d3ca477fab7e088522967b\",\n    gitHubIssue: \"10\",\n    mdxType: \"ViewDiffButton\"\n  }), mdx(\"h2\", {\n    \"id\": \"span-idree-02mree-02m-inexistent-hook-access-controlspan\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h2\",\n    \"href\": \"#span-idree-02mree-02m-inexistent-hook-access-controlspan\",\n    \"aria-label\": \"span idree 02mree 02m inexistent hook access controlspan permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), mdx(\"span\", {\n    id: \"REE-02M\"\n  }, \"REE-02M: Inexistent Hook Access Control\")), mdx(\"table\", null, mdx(\"thead\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"thead\"\n  }, mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Type\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Severity\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Location\"))), mdx(\"tbody\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/sova-network-fountfi-protocol-684adfa36579f5001821a219/appendix/finding-types#logical-fault\"\n  }, \"Logical Fault\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-medium\",\n    \"src\": \"https://omniscia.io/report-assets/medium.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"b\", null, \"RulesEngine.sol\"), \":\", mdx(\"br\", null), \"\\u2022 \", mdx(\"span\", {\n    title: \"Instance 1\"\n  }, \"I-1:\"), \" \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/hooks/RulesEngine.sol#L205-L212\"\n  }, \"L205-L212\"), mdx(\"br\", null), \"\\u2022 \", mdx(\"span\", {\n    title: \"Instance 2\"\n  }, \"I-2:\"), \" \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/hooks/RulesEngine.sol#L217-L224\"\n  }, \"L217-L224\"), mdx(\"br\", null), \"\\u2022 \", mdx(\"span\", {\n    title: \"Instance 3\"\n  }, \"I-3:\"), \" \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/hooks/RulesEngine.sol#L229-L236\"\n  }, \"L229-L236\"), mdx(\"br\", null), \"\\u2022 \", mdx(\"span\", {\n    title: \"Instance 4\"\n  }, \"I-4:\"), \" \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/hooks/RulesEngine.sol#L259-L261\"\n  }, \"L259-L261\"))))), mdx(\"h3\", {\n    \"id\": \"description-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#description-1\",\n    \"aria-label\": \"description 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Description:\"), mdx(\"p\", null, \"The \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/hooks/RulesEngine.sol#L247-L285\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"RulesEngine::_evaluateSubHooks\")), \" function indicates that it is meant to perform a low-level \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"call\"), \" operation instead of a \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"staticcall\"), \" operation as a hook should be able to modify its state.\"), mdx(\"p\", null, \"The current approach is incorrect as the various before function hooks do not apply any access control, permitting any user to invoke them directly and thus cause any sub hook that relies on state changes to be corrupted.\"), mdx(\"h3\", {\n    \"id\": \"impact-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#impact-1\",\n    \"aria-label\": \"impact 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Impact:\"), mdx(\"p\", null, \"While normally of major severity, the absence of a stateful hook in the current implementation of the system diminishes the impact of this vulnerability to a future iteration or hook introduction.\"), mdx(\"h3\", {\n    \"id\": \"example-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#example-1\",\n    \"aria-label\": \"example 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Example:\"), mdx(\"pre\", null, mdx(\"code\", {\n    parentName: \"pre\",\n    \"className\": \"language-sol\",\n    \"metastring\": \"title=src/hooks/RulesEngine.sol highlight={13,14,15} lineNumbers=true lineOffset=246\",\n    \"title\": \"src/hooks/RulesEngine.sol\",\n    \"highlight\": \"{13,14,15}\",\n    \"lineNumbers\": \"true\",\n    \"lineOffset\": \"246\"\n  }, \"function _evaluateSubHooks(bytes memory callData) internal returns (IHook.HookOutput memory) {\\n    bytes32[] memory sortedHookIds = _getSortedActiveHookIds();\\n\\n    for (uint256 i = 0; i < sortedHookIds.length;) {\\n        bytes32 hookId = sortedHookIds[i];\\n        HookInfo memory hook = _hooks[hookId];\\n\\n        // Check hook is active, if not, break loop - we've processed all active hooks\\n        if (!hook.active) {\\n            break;\\n        }\\n\\n        // Call the sub-hook with the appropriate evaluation function - use call instead of staticcall\\n        // to allow hooks to modify state (emit events, track interactions, etc.)\\n        (bool success, bytes memory returnData) = hook.hookAddress.call(callData);\\n\\n        if (!success) {\\n            // Sub-hook execution failed (reverted without a known bytes4 selector)\\n            // Attempt to decode a string reason if possible, otherwise generic failure.\\n            // This part is tricky as revert reasons are not always returned or standard.\\n            // For now, let's assume a specific error selector if the call itself fails.\\n            revert HookEvaluationFailed(hookId, bytes4(0)); // Generic failure selector\\n        }\\n\\n        // Decode the hook output from response\\n        IHook.HookOutput memory hookOutput = abi.decode(returnData, (IHook.HookOutput));\\n\\n        if (!hookOutput.approved) {\\n            return hookOutput;\\n        }\\n\\n        unchecked {\\n            ++i;\\n        }\\n    }\\n\\n    // If we made it through all hooks, operation is allowed\\n    return IHook.HookOutput({approved: true, reason: \\\"\\\"});\\n}\\n\")), mdx(\"h3\", {\n    \"id\": \"recommendation-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#recommendation-1\",\n    \"aria-label\": \"recommendation 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Recommendation:\"), mdx(\"p\", null, \"We advise either access control to be applied on the various before hooks or their mutability to be adjusted to \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"view\"), \", either of which we consider an adequate alleviation of this exhibit.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-e4d6885477\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-e4d6885477\",\n    \"aria-label\": \"alleviation e4d6885477 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (e4d6885477):\"), mdx(\"p\", null, \"The Sova Network team evaluated this exhibit and opted to acknowledge the risk, introducing a note to the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"BaseHook\"), \" implementation denoting that access control should be considered if stateful hook implementations are introduced.\"), mdx(\"p\", null, \"We would like to note that this results in a slight contradiction of the code as the relevant functions should be explicitly marked as \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"view\"), \" in the current state so as to avoid misleading hook developers.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-08da17ef72\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-08da17ef72\",\n    \"aria-label\": \"alleviation 08da17ef72 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (08da17ef72):\"), mdx(\"p\", null, \"The Sova Network team evaluated this exhibit and specified that dependencies are expected to implement mutable functions.\"), mdx(\"p\", null, \"As a result, we consider this exhibit safely acknowledged \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"based on the fact that the Sova Network team is aware all mutable hooks should implement some form of access control\"), \".\"), mdx(ViewDiffButton, {\n    repoUrl: \"https://github.com/SovaNetwork/fountfi\",\n    mainHash: \"fca2fe922e699e8762410f40e249961b53c3bf92\",\n    fixHash: \"08da17ef72c9b5c80834e03aade18389eb31a3af\",\n    gitHubIssue: \"11\",\n    mdxType: \"ViewDiffButton\"\n  }));\n}\n;\nMDXContent.isMDXComponent = true;","headings":[{"depth":2,"value":"<span id=\"REE-01M\">REE-01M: Inexistent Truncation of Active ID Array</span>"},{"depth":3,"value":"Description:"},{"depth":3,"value":"Impact:"},{"depth":3,"value":"Example:"},{"depth":3,"value":"Recommendation:"},{"depth":3,"value":"Alleviation (e4d6885477438291b0d3ca477fab7e088522967b):"},{"depth":2,"value":"<span id=\"REE-02M\">REE-02M: Inexistent Hook Access Control</span>"},{"depth":3,"value":"Description:"},{"depth":3,"value":"Impact:"},{"depth":3,"value":"Example:"},{"depth":3,"value":"Recommendation:"},{"depth":3,"value":"Alleviation (e4d6885477):"},{"depth":3,"value":"Alleviation (08da17ef72):"}]}},"pageContext":{"slug":"/manual-review/RulesEngine-REE/","prev":{"label":"Registry.sol (RYR-M)","link":"/manual-review/Registry-RYR"},"next":{"label":"BaseReporter.sol (BRR-C)","link":"/code-style/BaseReporter-BRR"}}},"staticQueryHashes":["1954253342","2328931024","2501019404","973074209"]}