Authority: wrong assertion when removing a selector to adapter mapping #381
Description
When removing a selector to adapter mapping, the address of the adapter is an input but not used in the assertion. This means that potentially a method could be correctly removed, but a wrong adapter input would result in the event being fired with the wrong adapter address.
The correct implementation should be:
function removeMethod(bytes4 selector, address adapter) external override onlyWhitelister {
require(_adapterBySelector[selector] == adapter, "AUTHORITY_METHOD_NOT_APPROVED_ERROR");
delete _adapterBySelector[selector];
emit RemovedMethod(msg.sender, adapter, selector);
}
or by removing the adapter as input, as we are only interested in removing the method in this context
function removeMethod(bytes4 selector) external override onlyWhitelister {
require(_adapterBySelector[selector] != address(0), "AUTHORITY_METHOD_NOT_APPROVED_ERROR");
delete _adapterBySelector[selector];
emit RemovedMethod(msg.sender, _adapterBySelector[selector], selector);
}